DSAR: How to Handle a Data Subject Access Request

A DSAR, or data subject access request, is a request from a person to learn whether an organization processes their personal data and to receive a copy of it, with an explanation of how it is used. Under Article 15 of the GDPR, the response must include the personal data and supplementary information such as purposes, recipients, retention, and source, and it is due within one month of receipt, extendable by two further months for complex or numerous requests. The UK GDPR uses the same clock. In the US, the CCPA and the privacy laws of Virginia, Colorado, and Texas give consumers a comparable right with a 45-day deadline and one 45-day extension.

A DSAR process is one line of the broader GDPR compliance checklist, and it is the line individuals test directly.

What must a DSAR response include?

An Article 15 response has three parts: confirmation of whether you process the person's data, a copy of that data, and the supplementary information listed in Article 15(1) and (2). The table lists each element.

Two Court of Justice rulings set the standard. In Österreichische Post (C-154/21) on January 12, 2023, the Court held that the controller must give "the actual identity of those recipients" on request, with categories allowed only where recipients cannot yet be identified or the request is manifestly unfounded or excessive. In C-487/21 on May 4, 2023, it held that the copy must faithfully reproduce all the personal data, including extracts or whole documents where those are essential for the person to exercise their rights.

DSAR deadlines by law

The response clock differs by law, and so do the extension, fee, and appeal rules. The table compares six regimes as of October 2026.

Sources: GDPR Article 12; Data (Use and Access) Act 2025, section 76; 11 CCR § 7021; Va. Code § 59.1-577; C.R.S. § 6-1-1306; Tex. Bus. & Com. Code ch. 541.

Three details trip up multi-law programs. The CCPA clock runs during verification, so a slow identity check spends the window. The UK clock starts when requested identity information or a fee arrives and pauses during clarification, while the EDPB says the EU period starts, as a rule, on receipt. And every law in the table wants the extension notice inside the first period, so decide early.

How to verify identity without collecting excess data

Verify identity with information you already hold, and ask for more only when you have a specific doubt. Article 12(6) lets a controller with "reasonable doubts concerning the identity" of a requester ask for "additional information necessary to confirm the identity." The EDPB Guidelines 01/2022 on the right of access (version 2.1, adopted March 28, 2023) say a copy of an identity document "should generally not be considered an appropriate way of authentication," and that demanding one from a person already logged in to their account is disproportionate. Better methods are a login, a code sent to a known email address or phone number, or a match against details you hold.

California sets explicit standards. Under the CCPA regulations, a business must generally avoid requesting additional information for verification (11 CCR § 7060), can verify a non-accountholder's request to know categories by matching two data points and a request for specific pieces by matching three data points with a signed declaration under penalty of perjury (§ 7062), cannot charge for verification, and must delete information collected only for verification once the request is processed. Virginia, Colorado, and Texas let a controller decline a request it cannot authenticate "using commercially reasonable efforts" and ask for the information it needs.

The DSAR response workflow, step by step

Run every DSAR through the same eight steps so the record shows what you did and when. The EDPB's 2024 coordinated enforcement report on the right of access found that "a lack of a formal documented procedure can heighten the possibility of an infringement," and that requests sent through channels not set up for them often go unrecognized.

1. Intake. Accept requests through any reasonable channel, including email, web forms, and phone, and train front-line staff to recognize one; a requester does not have to cite the GDPR or use the term DSAR. The CCPA requires at least two methods, one of them a toll-free number, unless the business operates exclusively online and has a direct relationship with the consumer, in which case an email address is enough.
2. Log and acknowledge. Open a record the day the request arrives with the date of receipt, the law that applies, and the deadline. The CCPA requires confirmation within 10 business days, and the EDPB recommends stating the start and end of the response period.
3. Verify. Apply the identity rules above in proportion to the sensitivity of the data.
4. Scope. Use your data map to identify every system that holds the person's data, and ask for clarification only where you reasonably need it. Our guide to building a data privacy program covers the data inventory this step depends on.
5. Search and collect. Search production systems, CRM, support tickets, HR files, email, chat, shared drives, call recordings, logs, and data held by processors. The EDPB's 2024 review found controllers that searched only their most common databases and some that may not realize backups hold personal data.
6. Review, redact, and apply exemptions. Obscure other people's personal data where disclosure would adversely affect their rights under Article 15(4), and apply any national exemption, such as legal privilege under the UK Data Protection Act 2018. The EDPB says Article 15(4) "should not result in refusing the data subject's request altogether."
7. Respond and deliver. Send the data and the Article 15 information through a secure channel, in a commonly used electronic form when the request came electronically, and explain how to open any encrypted file.
8. Close the record. Log what you searched, what you withheld and why, and when you responded, and keep the file under your retention schedule.

Fees and manifestly unfounded or excessive requests

A DSAR is free in almost every case. Article 12(5) of the GDPR makes responses free of charge, and the controller may charge a reasonable fee or refuse only where a request is "manifestly unfounded or excessive, in particular because of their repetitive character," with the controller bearing the burden of showing it. The EDPB says those terms "have to be interpreted narrowly," and the ICO's guide to subject access, updated July 16, 2026, says "there is a high threshold for relying on these provisions." Article 15(3) allows a reasonable fee for further copies, and the US laws set frequency limits, as the deadlines table shows.

The EU abuse test may change. The European Commission's Digital Omnibus proposal of November 19, 2025 would amend Article 12(5) to address access requests made for purposes other than data protection. In Joint Opinion 2/2026 of February 10, 2026, the EDPB and EDPS objected to tying abuse to purpose and recommended defining abusive requests by an intention to cause harm. As of October 2026 the proposal was awaiting a committee decision in the European Parliament (procedure 2025/0360(COD)), so Article 12(5) applies as written.

Employee DSARs and litigation tactics

Current and former employees file the hardest DSARs, often during a dispute, and the dispute is no reason to refuse them. The EDPB guidelines work through a dismissed employee who requests data to support a lawsuit and conclude the controller must comply unless the request is manifestly unfounded or excessive, because the controller "should not assess 'why' the data subject is requesting access." The ICO says "The person's reason for making a SAR is not relevant to whether their request is valid," except when you weigh the manifestly unfounded or excessive provisions. The Court of Justice held in FT v DW (C-307/22) on October 26, 2023 that a patient was entitled to a free first copy of their medical records even though they wanted it to pursue a liability claim.

US employers face the same issue in California. The CCPA's exemption for employee and job applicant data expired on December 31, 2022, and the CPPA's FAQ confirms that employees and job applicants are covered. Virginia, Colorado, and Texas exclude people acting in an employment context from their definitions of consumer.

We recommend a five-part approach to an employee DSAR in a live dispute. Route the request to counsel and HR the day it arrives and preserve the data, because altering or destroying requested information to prevent disclosure is an offense under section 173 of the UK Data Protection Act 2018. Agree custodians, search terms, and date ranges in writing; under the EDPB guidelines an employer may ask a broad requester to narrow the request, but owes everything if the employee confirms they want it all. Review email and chat with eDiscovery tools, where volume and third-party data concentrate. Withhold privileged material and redact other people's data with a recorded reason for each decision. Keep the DSAR response separate from litigation disclosure so each meets its own rules.

How many DSARs will you get, and what does each cost?

Most organizations receive few access requests, and a handful of disputed ones drive a large share of the cost. The EDPB's coordinated enforcement report, adopted January 16, 2025, drew responses from 1,185 controllers across the EEA and found that around 74% received between zero and 10 access requests in 2023, though supervisory authorities suspected undercounting because many controllers had no central tracking. In California, businesses that handle the personal information of 10 million or more consumers must publish annual request counts and the median or mean days to respond by July 1 each year under 11 CCR § 7102, a public benchmark for large consumer brands.

We found no current independent study of cost per request worth citing, so the model below uses BD Emerson planning assumptions. Estimate annual volume from your last 12 months of intake, sort requests into three types, and multiply by effort and loaded labor cost.

BD Emerson planning ranges, October 2026. Shares and hours vary by sector and by how complete your data map is.

At an assumed loaded internal cost of $95 an hour, the example totals about $116,000 a year, or roughly $970 per request, and the six disputed requests consume 39% of the hours. The arithmetic shows where tooling pays back: fully automating the routine row would save 384 hours, fewer than the six disputed requests consume, so search and redaction capacity often matters more than a consumer request portal.

DSAR tools by category

No single tool answers a DSAR end to end, so match tools to the steps that consume your hours.

A discovery tool that scans employee mailboxes is processing in its own right, so check whether it needs a DPIA before it goes live; our guide on when a DPIA is required sets out the test.

DSAR log template

A DSAR log is the record that proves your timeliness and your reasoning. Keep one row per request with these fields; the example shows a completed GDPR request.

When to bring in counsel

Most DSARs are operational, and a trained privacy team can answer them without legal review. Bring in counsel when the request comes from an employee or anyone in a dispute with you, when you plan to refuse or charge a fee, when you rely on an exemption such as privilege, when the data includes another person's sensitive information, or when a regulator or court is involved. BD Emerson provides privacy consulting and DPO services and does not give legal advice, so where the answer turns on legal interpretation, we confirm the position with your counsel and keep the response moving.

Frequently asked questions

What does DSAR stand for? DSAR stands for data subject access request, a request by an individual to find out whether an organization processes their personal data and to receive a copy of it. The term comes from the GDPR, which calls the person a data subject and sets out the right in Article 15. US state laws describe the same thing as a request to know or a right to access.

How long do you have to respond to a DSAR? Under the GDPR and UK GDPR, one month from receipt, extendable by two further months for complex or numerous requests if you tell the requester within the first month. Under the CCPA, 45 calendar days, extendable by 45 more with notice, and you must confirm receipt within 10 business days. Virginia, Colorado, and Texas also set 45 days with one 45-day extension.

Can you charge a fee for a DSAR? Generally no. The GDPR makes responses free and allows a reasonable fee only for further copies or for requests that are manifestly unfounded or excessive, a test the EDPB says must be read narrowly. The CCPA and the Virginia and Texas laws make responses free at least twice a year, and Colorado allows a charge for a second or later request within 12 months.

Can you refuse a DSAR? Only in limited cases. Under the GDPR you may refuse a request that is manifestly unfounded or excessive, and you must be able to show it. You may withhold parts covered by a national exemption or redact other people's data under Article 15(4), but not refuse the whole request on that basis. When you refuse, explain why and tell the person they can complain to a supervisory authority.

Does a DSAR cover emails? Yes, when the emails contain the requester's personal data. Email is often the largest and most sensitive source, especially for employee requests, because messages about one person also contain other people's data. Search mailboxes with defined custodians, terms, and date ranges, then review and redact before release. The UK GDPR limits the search to what is reasonable and proportionate, and email stays in scope.

Do US companies have to answer DSARs? Yes, if a law reaches them. The GDPR applies to US companies that offer goods or services to people in the EU or monitor their behavior there. The CCPA and the privacy laws of states such as Virginia, Colorado, and Texas give residents access rights, subject to their own thresholds. A US company with EU customers and California employees can owe responses under several laws at once.

If DSARs are arriving faster than your team can log and answer them, or an employee request has arrived in the middle of a dispute, our DPO as a Service team can run intake, verification, search, and redaction with you and keep the log that shows you met each deadline.