Modern privacy laws give individuals significant control over how their personal data is used by organizations. Two of the most commonly exercised rights are the Data Subject Access Request (DSAR) and the data deletion request, often called the right to erasure.
Although these rights are frequently mentioned together, they serve very different purposes. A DSAR allows individuals to access and understand the personal data an organization holds about them, while a data deletion request asks the organization to remove that data under certain conditions.
For businesses, confusing these two requests can create compliance risks. Each request triggers different legal obligations, timelines, and operational procedures. Organizations must be able to recognize the difference and respond appropriately.
The Legal Foundation of Both Rights
Both DSARs and data deletion requests are established under the General Data Protection Regulation, one of the most comprehensive privacy regulations in the world.
The regulation grants individuals a set of rights designed to increase transparency and control over personal data. Among these rights are:
- the right of access, which enables individuals to request copies of their personal data
- the right to erasure, which allows individuals to request that certain personal data be deleted
Although both rights involve personal data, their objectives are fundamentally different.
Understanding this distinction is essential for organizations responsible for managing privacy requests.
What Is a Data Subject Access Request (DSAR)?
A Data Subject Access Request is a request made by an individual to obtain confirmation that an organization is processing their personal data and to receive a copy of that data.
The primary purpose of a DSAR is transparency.
When responding to a DSAR, an organization must typically provide:
- a copy of the personal data held about the individual
- information about how the data is used
- the purposes of processing
- categories of personal data involved
- recipients or categories of recipients of the data
- retention periods
- information about the individual’s privacy rights
This response helps individuals understand how their personal information is collected, stored, and shared.
Importantly, a DSAR does not require the organization to delete any data. The organization is only obligated to disclose the information and provide the required explanations.
What Is a Data Deletion Request?
A data deletion request is based on the right to erasure, which allows individuals to request that an organization remove their personal data under specific circumstances.
The goal of a deletion request is data removal, not access.
When a valid deletion request is submitted, an organization may need to:
- erase personal data from its systems
- remove information from databases
- delete records stored in backups or archives where feasible
- inform third parties that received the data about the deletion request
However, the right to erasure is not absolute. Organizations may refuse deletion if the data must be retained for legitimate reasons.
Examples include:
- legal obligations
- regulatory compliance
- contractual requirements
- fraud prevention
- the establishment or defense of legal claims
Because of these limitations, deletion requests often require careful evaluation before any data is removed.
Core Differences Between DSARs and Data Deletion Requests
Although both rights relate to personal data, several key differences separate them.
Purpose of the Request
The most important distinction lies in the objective.
A DSAR is designed to provide transparency and allow individuals to see what personal data an organization holds about them.
A data deletion request aims to remove that data from the organization’s systems.
In simple terms:
- DSAR = access and transparency
- Deletion request = removal of data
Legal Basis Under Privacy Law
The two requests originate from different provisions of the General Data Protection Regulation.
- DSARs arise from Article 15 (Right of Access)
- Deletion requests arise from Article 17 (Right to Erasure)
Because they are separate rights, organizations must treat them independently.
Obligations for Businesses
The obligations triggered by each request also differ.
DSAR obligations
When responding to a DSAR, organizations must:
- locate personal data related to the requester
- provide a copy of that data
- supply required processing information
The data is not removed from systems.
Deletion request obligations
When handling a deletion request, organizations must determine whether the request meets legal conditions for erasure.
If it does, the organization must delete the relevant personal data unless an exception applies.
Operational Complexity
Both requests can be operationally demanding, but in different ways.
DSAR responses often require extensive data discovery, particularly when personal data is stored across multiple systems such as:
- CRM platforms
- email systems
- customer support tools
- cloud storage environments
Deletion requests, on the other hand, require careful data lifecycle management to ensure that information is properly erased without violating retention obligations.
Impact on Internal Systems
A DSAR response typically involves gathering and compiling information from different data sources.
A deletion request may require organizations to:
- delete records across multiple databases
- ensure third-party processors also delete the data
- confirm that future processing of the data stops
Because of these differences, the internal workflows for the two requests are usually separate.
When Individuals Submit Both Requests Together
In practice, individuals sometimes combine multiple privacy rights in a single message.
For example, someone might ask:
- to see all personal data held about them
- and to have it deleted afterward
When this happens, organizations must treat the requests individually, even if they arrive at the same time.
Typically, organizations will:
- process the DSAR first to identify the relevant personal data
- evaluate whether the deletion request can legally be fulfilled
This approach ensures that the organization fully understands the data involved before deciding whether it can be erased.
Common Business Mistakes
Organizations frequently make mistakes when handling these two types of requests.
Treating a DSAR as a Deletion Request
Some businesses assume that when an individual asks about their data, they want it deleted.
This assumption can lead to premature data removal, which may create compliance problems if the data must be retained for legal reasons.
Ignoring Deletion Requests Because Data Exists
Another common mistake occurs when organizations believe they cannot delete data simply because it exists in their systems.
In reality, they must evaluate whether legal grounds for retention apply before rejecting a deletion request.
Failing to Recognize Informal Requests
Privacy rights do not require specific wording.
An individual does not need to mention legal terms like “DSAR” or “right to erasure.” Any request that clearly seeks access to personal data or deletion of personal data should be treated accordingly.
Organizations must therefore train staff to recognize these requests even when they appear in informal communications such as emails or support messages.
Practical Steps for Businesses
To handle both DSARs and deletion requests effectively, organizations should implement structured procedures. Key steps include:
Establish clear request identification
Organizations should create internal guidance to help employees recognize different types of privacy requests.
Maintain data inventories
Understanding where personal data is stored makes it much easier to respond to both access and deletion requests.
Create separate workflows
Because DSARs and deletion requests involve different processes, organizations should maintain dedicated procedures for each.
Document decision-making
When responding to deletion requests, organizations should document why data was deleted or retained.
This documentation can be important if regulators later review the organization’s compliance practices.
Why Understanding the Difference Matters
The difference between DSARs and deletion requests may appear simple, but it has significant implications for compliance.
Organizations that misunderstand these rights may:
- provide incomplete responses
- delete data improperly
- fail to respect legitimate privacy requests
Clear internal policies, staff training, and structured data management practices are essential to handle these requests correctly.
Conclusion
A Data Subject Access Request (DSAR) and a data deletion request serve different purposes under the General Data Protection Regulation.
A DSAR focuses on transparency, allowing individuals to see what personal data an organization holds and how it is used. A deletion request focuses on removal, asking organizations to erase personal data when certain legal conditions are met.
For businesses, recognizing this distinction is essential. Each request triggers different legal obligations, operational processes, and compliance considerations.
Organizations that clearly separate these workflows and maintain strong data governance practices will be far better prepared to manage privacy requests effectively.
