What is Data Subject Access Request?
Also called DSAR, Subject Access Request.
A data subject access request is a formal request from an individual asking an organization to confirm whether it processes their personal data and to provide a copy along with details of that processing. Recognized under the GDPR and comparable laws, it carries statutory response deadlines and is one of the most common ways privacy compliance is tested in practice.
A complete response typically covers more than the raw data. It includes the purposes of processing, the categories of data involved, the recipients or categories of recipients, the expected retention period, the source of the data where it was not collected from the person, the existence of other rights such as correction and erasure, and whether automated decision making is involved.
Deadlines are short relative to the work involved. Under the GDPR the baseline is one month, extendable in limited circumstances, and other regimes set their own clocks. Organizations that have not mapped where personal data lives usually discover this during their first serious request, when a manual search across systems consumes far more time than the deadline allows.
Identity verification matters and cuts both ways. Releasing data to an impostor is itself a breach, so requests are verified proportionately, but verification must not become an obstacle that effectively denies the right. Requests are normally free, and organizations may charge or refuse only in narrow cases such as manifestly unfounded or excessive repetition.
AI systems complicate assembly because a person's data may sit in conversation transcripts, uploaded files, tool call records, retrieval indexes and audit logs. Third party content mixed into those records raises a further problem, since disclosing one person's data must not expose another's. Responses often require targeted redaction rather than a bulk export.
Key points
- Covers the data plus purposes, recipients, retention and sources
- Statutory deadlines are short, commonly around one month
- Verify identity proportionately without blocking the right
- A data map is what makes responses feasible at all
- Redact third party data before disclosing records
In practice
A customer submits a request asking for everything a platform holds about them. The privacy team pulls the account record, billing history, support tickets, chat transcripts and uploaded files, then reviews the transcripts to redact names of other people mentioned by support staff. The package is delivered with a summary of processing purposes, the retention schedule for each store, and a note that transcripts are deleted after ninety days.