What Is a Data Subject Access Request?
TL;DR
A data subject access request, or DSAR, is a person asking an organisation for a copy of the personal data it holds about them, a right granted by GDPR Article 15. The organisation has one month from receipt to respond, extendable by two further months where the request is complex or requests are numerous.
What does a DSAR entitle the person to?
A copy of their personal data, and with it a set of explanations. Article 15 requires the purposes of the processing, the categories of data concerned, the recipients or categories of recipient it has been disclosed to, and the retention period or the criteria used to set one. It also requires you to say where the data came from if it did not come from them, whether automated decision-making is involved, and that they may complain to a supervisory authority.
The source disclosure is the part that catches outreach programmes. Someone who never gave you their address will ask where you got it, and Article 15 obliges an answer. A list acquired without recorded provenance becomes a compliance problem at that moment, well before it becomes a deliverability problem.
How long do you have to respond, and can you charge?
Article 12(3) sets one month from receipt, without undue delay. That can be extended by two further months where necessary given the complexity and number of requests, provided you tell the person within the first month and explain why. Article 12(6) lets you ask for information needed to confirm identity before you disclose anything.
Responses are free. A reasonable fee, or a refusal, is possible only where a request is manifestly unfounded or excessive, and the threshold for that is high enough that it is rarely the right first answer. How to word a particular refusal is a legal judgement; the point a definition can make is that the default is compliance within the month.
What makes a DSAR hard to answer in practice?
Scattered copies. The same contact record can sit in a CRM, a sending platform, an enrichment export, a spreadsheet somebody downloaded and a support ticket, and Article 15 covers all of it. Organisations that answer DSARs comfortably are the ones that knew where the data lived before the request arrived.
The other difficulty is third-party data. A record often contains information about someone other than the requester, and that has to be considered rather than disclosed automatically, which is why redaction is a normal part of a response rather than a sign of evasion.
Frequently asked questions
No. A request can arrive in any form, including a verbal one or a reply to one of your campaigns, and it does not have to use the phrase data subject access request or cite Article 15. The clock starts when it reaches the organisation, however informally it is worded.