← Glossary

Regulation & Compliance

Data subject access request (DSAR)

Also: DSAR · SAR · subject access request · right of access · GDPR Article 15 · access request

Last reviewed: — regulation changes; check the primary source below before relying on a date or a threshold.

In one sentence

A data subject access request is a request, under Article 15 of the GDPR, asking an organisation whether it holds personal data about you and, if it does, for a copy of that data plus what it uses it for, who it shares it with, how long it keeps it and where it got it.

What the organisation must give you

Article 15(1) gives you a confirmation of whether your data is processed and, if so, access to it together with:

  • the purposes of the processing and the categories of data concerned;
  • the recipients, in particular recipients outside the EU;
  • how long the data will be stored, or the criteria used to decide;
  • your other rights (rectification, erasure, restriction, objection) and the right to complain to a supervisory authority;
  • the source of the data, if it was not collected from you;
  • any automated decision-making or profiling, with meaningful information about the logic involved.

Article 15(3) adds a copy of the data itself. The first copy is free; the organisation may charge a reasonable fee for further copies. If you ask electronically, the answer comes in a commonly used electronic form unless you ask otherwise.

Deadlines, fees and identity checks

  • One month. Article 12(3): the answer is due without undue delay and at the latest one month after the request arrives. The organisation may extend by two further months for complex or numerous requests, but it must tell you within the first month and say why.
  • Free of charge. Article 12(5): a fee or a refusal is only allowed for requests that are manifestly unfounded or excessive, for example repetitive ones, and the organisation has to prove it.
  • Identity. Article 12(6): if the organisation has reasonable doubts about who you are, it may ask for the information it needs to confirm your identity. Give the e-mail address or customer number they already know rather than more personal data than necessary.
  • No answer. Article 12(4): if they decide not to act, they must say why within one month and tell you that you can complain to a supervisory authority (Article 77) or go to court.

Try it yourself hands-on

Alice Example keeps receiving catalogues from Example Shop S.A., a store she has never ordered from. She wants to know what they hold and where they got her address.

  1. Open the GDPR Request Generator with Access (Art. 15) already selected, and pick the letter language.
  2. Under Who are you writing to?, type Example Shop S.A. and, if the privacy policy lists one, their privacy e-mail (for example privacy@example.com).
  3. Under About you, type Alice Example and the address the catalogues arrive at. That is the identifier they hold, so it lets them find her record without asking for an ID card.
  4. In Anything specific?, write that she wants to know the source of her address (Article 15(1)(g)) and every company it was shared with (Article 15(1)(c)).
  5. Check the preview, then copy the letter, download it as .txt or .pdf, or open it in your e-mail app. The Deadlines and next steps box shows the date the one-month period ends. Nothing you type leaves your browser.

If the answer names a data broker as the source, the data brokers guide explains the next steps: an access request to the broker, then an erasure request or an objection to direct marketing.

Common mistakes

  • Sending it to the wrong address. Use the contact in the privacy policy or the data protection officer's address. A request to any channel of the organisation is still valid, but a generic support desk loses time.
  • Not keeping proof of the date. The month runs from receipt. Keep the sent e-mail or the postal receipt.
  • Accepting a partial answer. A copy of the data without the purposes, recipients and retention period is incomplete; reply and point to the missing points of Article 15(1).