DSAR
Data Subject Access Request — a formal request from an individual to access the personal data an organisation holds about them.
Full Definition
A Data Subject Access Request (DSAR) is a formal request made by an individual exercising their right to access personal data. Under GDPR, organisations must respond within 30 days (extendable to 3 months), providing a copy of the data, the purposes of processing, categories of recipients, retention periods, and information about other data subject rights. Under CCPA, businesses have 45 days. Under India's DPDP Act, the right includes access to a summary of personal data and processing activities. DSARs can encompass other rights too — deletion, correction, portability, and objection requests are sometimes grouped under the DSAR umbrella.
How each law treats it
30 calendar days to respond, extendable to three months for complex requests. Verification must be proportionate.
45 days with one 45-day extension. Verifiable consumer request standard applies — the business must verify identity before responding.
Access, correction/erasure, grievance redressal and nomination. The response period is set by each Fiduciary's published grievance redressal period.
Response 'as soon as reasonably possible'; practice is 30 days unless the PDPC extends by consent.
In practice
- Set a single 30-day target as the operational SLA across all regulations; narrow per-jurisdiction only when the local rule is stricter.
- Capture the deadline in the DSR tracker on receipt. Autopilot handles the clock better than manual spreadsheets.
- Keep the completed response + the identity-verification evidence for seven years as the audit trail.
Common pitfalls
- Failing to recognise a DSR arriving by email or chat. Any clear request to exercise a right is a DSR regardless of how it arrived.
- Treating 'can't find anything' as a complete response. Where no data exists, the response must still say so explicitly.
- Charging a fee outside the narrow permitted cases. GDPR and CCPA both constrain fee-charging to repeat/excessive requests.
Frequently asked questions
What's a 'verifiable consumer request' under the CCPA?+
A request where the business can reasonably verify that the person making it is the consumer whose data is involved. The CPPA regulations set verification tiers (two factors for sensitive data, one for less-sensitive).
Does the DSR deadline run in business days or calendar days?+
Calendar days under GDPR and CCPA. The PDPC accepts practical adjustments when the final day falls on a Singapore public holiday. DPDP uses the Fiduciary's published period.
What if the request is manifestly unfounded or excessive?+
GDPR Article 12(5) allows refusal with reasons, or the charging of a reasonable fee. The refusal must be documented — the DPA will ask for the reasoning.
Related terms
Right to Access
A data subject's right to obtain confirmation of whether their personal data is being processed and to receive a copy of it.
Data Subject
An identified or identifiable natural person whose personal data is being processed.
Right to Erasure
An individual's right to have their personal data deleted ('right to be forgotten') in certain circumstances.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes