Data Subject Access Request (DSAR): The Framework
A Data Subject Access Request (DSAR) is a right exercised by an individual, not a document you produce proactively. Under Article 15 of the GDPR, a person can ask you to confirm whether you process their personal data and to provide access to it — and you must respond within one month of receiving the request.
This is the framework page for the DSAR — the single definition the blog links to instead of re-explaining the right each time.
How a DSAR works
A valid DSAR does not need to say "subject access request" or cite Article 15. It can be made verbally or in writing, through any channel, to anyone in the organisation. All it needs is enough to identify the requester and make clear they want their personal data.
Article 12(3) gives you one month from the day the request lands, extendable by up to two further months for complex or numerous requests — but you must tell the requester within the first month and explain why. Identity verification and clarification of scope can pause the clock; the response period resumes when you have what you asked for.
What a response must contain
Article 15 asks for more than a copy of the data. The response must confirm the processing and set out the purposes, the categories of data, the recipients (including any in a third country), the retention period or how it is set, the source of the data, the requester's rights, and the existence of any automated decision-making.
Read that list and it should look familiar: it is your Article 30 record, restated for one person.
The DSAR depends on the rest of the framework
A DSAR is graded by work you did before the request existed. To scope the search, name the recipients and state the retention period, you read your RoPA. The request itself tests the records that your DPIA assessments built on. A current register turns the search into a lookup; a stale one turns it into archaeology.
For the full handling guide — the clock, legitimate stopping, refusal grounds, redaction and privilege — see our guide to how to respond to a Data Subject Access Request.