DataTerminology.comNEW
Also known as: DSAR, Subject Access Request
An individual’s request to confirm, access, and obtain a copy of personal data held about them.
DESCRIPTION
A Data Subject Access Request (DSAR) is the exercise of the right of access, enabling individuals to obtain confirmation of processing and a copy of their personal data. Controllers must respond within statutory time limits and provide supplementary information such as purposes, recipients, and retention periods. Identity verification and data redaction safeguards are critical to avoid unauthorized disclosure. Scalable DSAR processes rely on accurate data inventories and automated discovery across systems and vendors.
ALTERNATIVE DEFINITIONS
EU GDPR (Regulation (EU) 2016/679)
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data.
Captures both confirmation of processing and access to personal data.
UK Information Commissioner’s Office (ICO)
The right of access gives individuals the right to obtain a copy of their personal data as well as other supplementary information.
Highlights the obligation to include explanatory information with the data copy.
RELATED TERMS
Right to be Forgotten Right to Rectification Data Controller Data Processor Authentication Privacy by Design Data Mapping Records of Processing Activities Privacy Notice
COMPETING TERMS
KNOWLEDGE AREAS
Data Privacy & Compliance Data Governance Data Management
TARGET AUDIENCE
Data Governance Manager Data Steward Chief Data Officer Chief Information Officer Data Engineer Information Analyst
EXTERNAL SOURCES
- Wikipedia - Subject access request
- ICO - Comprehensive guidance on right of access
- European Data Protection Board - EDPB guidelines on right of access
TOP QUESTIONS
What information must be provided in response to a Data Subject Access Request?
A copy of personal data and supplementary details like purposes, categories, recipients, retention, rights, and source. Redact others’ data and trade secrets if justified.
Category: Requirements
How long do we have to respond to a Data Subject Access Request?
Generally one month from receipt, with possible extensions where complex, as permitted by law. Record reasons for any extension.
Category: Compliance
Can a Data Subject Access Request be refused?
Requests may be refused if manifestly unfounded or excessive, or where exemptions apply. Provide reasons and inform about complaint rights.
Category: Risks
How should identity be verified for a Data Subject Access Request?
Use proportionate verification based on risk, such as email confirmation or government ID. Avoid collecting excessive new data.
Category: Process
What are common mistakes in Data Subject Access Requests handling?
Poor data mapping, missing third-party data, inadequate redaction, and missed deadlines are common pitfalls.
Category: Mistakes
How do processors support a controller with a Data Subject Access Request?
Processors must assist controllers by providing relevant data and actions under contract terms and legal obligations.
Category: Governance
How do we handle large volumes in a Data Subject Access Request?
Use search automation, scoping with the requester, and staged delivery. Provide secure portals for access.
Category: Practice
Does a Data Subject Access Request include inferred data?
In many cases yes, if inferences are personal data. Trade secrets may be protected; assess case-by-case.
Category: Opinion
What evidence should be retained for a Data Subject Access Request?
Track timestamps, verification steps, systems queried, data delivered, redactions, and communications for audit.
Category: Audit