The Complete Guide to Data Subject Access Requests (DSAR) for Businesses

As privacy regulations evolve, organizations collecting personal data must be ready to answer customers’ questions about their data. A Data Subject Access Request (DSAR) is a formal demand by an individual to access the personal information your company holds about them. Whether you operate a SaaS platform, an online marketplace, or any business processing customer data, handling DSARs efficiently is now a critical part of compliance.

This guide provides a comprehensive overview of DSARs, covering:

What a DSAR is and why it matters
Legal requirements under the GDPR
The DSAR request lifecycle step-by-step
Response deadlines and verification steps
How to find and compile data from your systems
Common DSAR response examples
Typical mistakes and pitfalls
How automation and workflows can simplify compliance

By the end, you’ll understand the key challenges businesses face with DSARs and how to streamline your DSAR process—potentially using automation tools like DSARify.

What Is a Data Subject Access Request?

A DSAR is a request from an individual (the data subject) asking an organization (the data controller) to provide access to their personal data. In practical terms, this means the person wants to know:

What personal data you have about them
Why you are processing it
Who you have shared it with
How long you will retain it
Any other details about processing

GDPR grants every data subject the right to obtain confirmation that you process their data and a copy of that data. In other words, if someone exercises their right of access, you must give them the information without undue delay.

Examples: A customer asking for all information your CRM has about them, an employee requesting emails from HR, or a visitor wanting records of their website interactions.

Why DSARs Matter

Handling DSARs properly is about both compliance and trust:

Legal obligation: Under GDPR Article 15, failing to respond or providing incomplete info can lead to complaints and fines up to €20 million or 4% of global turnover.
Customer trust: Well-handled DSARs show you respect privacy, building customer confidence.
Operational efficiency: A structured DSAR process reduces last-minute scrambling and mistakes.

In recent years, DSARs have become common as more people know their data rights. Companies that adopt clear, repeatable DSAR procedures often find the process smoother and faster over time.

DSAR vs Other Privacy Requests

It’s useful to distinguish a DSAR from other data requests:

DSAR (Access request): Asking what data you have and copies of it.
Data Deletion request: Asking you to erase personal data. (GDPR Article 17)
Data Correction request: Asking you to fix inaccurate data. (Article 16)
Data Portability request: Asking for data in a machine-readable format. (Article 20)

Each has its own rules, but they share the principle: the person has control over their data. This guide focuses on access requests (DSARs), which are often the first point of contact for privacy compliance.

The DSAR Process: Step by Step

A well-defined DSAR workflow keeps everything organized. Here’s a typical process:

Acknowledge the request: As soon as you receive a DSAR, send a quick confirmation email.
Verify identity: Confirm the person’s identity before sharing data.
Search data sources: Gather all relevant personal data from your systems.
Review and prepare the response: Redact unrelated data and organize the info.
Deliver securely: Provide the data using a secure method.
Document the process: Keep records of how you handled the request.

Each step is important. Skipping or rushing steps can lead to errors or delays.

1. Acknowledge Quickly

Although GDPR doesn’t strictly require an immediate acknowledgment, it’s a best practice to respond within 24–48 hours. Your acknowledgment should:

Confirm you received the request and the date.
Give a reference number for tracking.
Explain next steps (identity check, data search).
State the expected deadline (usually 30 days, explained below).

Using a template makes this faster and ensures consistency.

2. Verify the Requestor’s Identity

Before sharing any personal data, verify that the request is genuine. This protects against unauthorized access.

Verification should be proportional:

Low-risk: If the request comes from a logged-in user’s email, you might only need a confirmation email click.
Higher-risk: For sensitive data, require government ID or security questions.

Always document how you verified identity (e.g. “Verified via account credentials” or “Received scanned ID and proof of address”). If identity can’t be confirmed, inform the person and pause the process.

3. Log and Track the Request

Use an internal DSAR tracker (it can be as simple as a spreadsheet or as advanced as a software tool):

Record the request date and status.
Note who is handling each part.
Set reminders for deadlines.

Tracking helps ensure nothing falls through the cracks and provides an audit trail.

4. Search All Data Sources

This step is often the most time-consuming. You must find every piece of personal data the requester asked for.

Common data sources include:

Customer databases (CRM) – e.g. contact info, transactions.
Email systems – business emails with personal data.
Support tools – chat logs, tickets.
Marketing platforms – newsletters, campaign data.
Analytics tools – web behavior, cookie data.
Third-party vendors – if they process data on your behalf (you are still responsible).
HR/payroll systems – for employee data.
Backup archives – any old storage (cloud or physical).
Physical files – paper forms, signed documents.
Other apps – Slack messages, Dropbox files, database records, etc.

Maintain a data inventory of where data lives—this speeds up the process.
Some companies use DSAR management software (like DSARify) to search across systems or at least to coordinate tasks.

5. Review and Prepare the Response

Once you gather data, review it carefully:

Redact third-party personal data: Remove information about other individuals unless you have consent.
Remove privileged info: Omit confidential business secrets if they were captured.
Format clearly: Present the data in an understandable way (e.g. chronological emails, grouped by category).
Include required context: Explain how and why the data is processed, the legal basis, retention policies, etc.

It often helps to have another person (like a Data Protection Officer) review the draft to catch mistakes or omissions.

6. Deliver the Response Securely

Choose a secure delivery method appropriate for the data’s sensitivity:

Encrypted email attachment: Send the file encrypted; share the password via a different channel.
Secure portal: Upload documents to a secure link only the requestor can access.
Password-protected PDF: Protect the PDF with a strong password.
Registered mail: If requested or if digital delivery isn’t practical.

Record how and when you delivered it, and keep a copy for your records. After sending, remain available to answer any follow-up questions.

DSAR Deadlines Explained

Under GDPR, businesses have 1 month to respond to a DSAR. This runs from the day you receive the request (or from day of verification if you needed more info).

You can extend this by 2 more months if the request is complex (e.g., large amounts of data or multiple departments involved). If you extend, you must inform the requester by the 1-month mark and explain why.

Missing the deadline can lead to complaints to regulators. Many companies set up automated reminders or use DSAR software to track deadlines.

Identity Verification Requirements

Verifying identity is essential to ensure privacy and compliance.

Ask for enough information to confirm identity without unnecessary detail.
Common proofs: government ID (Passport/Driver’s License), recent utility bill, or known account info.
If an attorney or family member requests on someone’s behalf, require a signed authorization or power of attorney.

Tip: Allow redaction of sensitive parts of IDs (e.g., only the name and birthdate need to be visible).

Document the verification step. For example: “Verified via government ID and matching address.”

How to Find All Personal Data

Modern businesses often deal with fragmented data. To avoid missing anything:

Maintain a Data Map: List where each type of personal data is stored (e.g., contact info in CRM, purchase history in ERP).
Use DSAR search tools or scripts if available. For instance, some DSAR platforms can query multiple systems automatically.

Check every possible place, even unexpected ones. If your app has a connector or similar, you might automate searches across Google Sheets, databases, cloud storage, etc.

Common DSAR Response Examples

A typical DSAR response might look like:

Database dump: A CSV of the data fields (name, email, purchase dates, etc.).
PDF report: A report generated by your CRM.
Screenshot or export: If data is only in a closed system.

Plus, an accompanying letter or email explaining:

“We process your data to fulfill your orders. We shared your email with our shipping partner X. We will keep this data for 5 years as per our retention policy. You have the right to correct any inaccuracies or request deletion at any time.”

Providing both the raw data and clear explanations is best practice.

Common DSAR Pitfalls

Even with a process, mistakes happen. Watch out for:

Starting late: DSARs often come unexpectedly. Begin the search immediately, don’t wait.
Incomplete searches: If a department wasn’t involved, check if they have data (e.g. finance, tech support).
Missed communication: Ensure every DSAR request is logged centrally; emails only easily get lost.
Over-redacting: Hide only what you legally must. Overzealous redaction can frustrate the requester.
No documentation: Keep a record of every step: receipt, verification method, data sources checked, response sent.

Addressing these avoids regulatory headaches and builds trust with data subjects.

Scaling DSAR Processes

For small businesses with one request a quarter, manual handling might suffice. But as your data footprint grows:

Centralize tracking: Use a dedicated DSAR management tool (e.g., DSARify) or a shared project board.
Define ownership: Assign a privacy officer or team member to oversee each request.
Templates: Create email templates for acknowledgments, identity verification, and response delivery.
Regular audits: Periodically test your process (e.g., run mock DSARs to see how long it takes).

Putting these in place early means new requests don’t become a crisis.

Automation and Workflow Integration

Handling DSARs often means repetitive tasks across systems. This is where automation and workflow tools shine.

For example, with a workflow platform, you could:

Automatically detect incoming DSAR emails and create a ticket.
Trigger parallel searches: query CRM, databases, document storage simultaneously.
Compile results into a standardized report format.
Send reminder emails at 2 weeks to track progress.
Store an audit log of each action taken.

Several DSAR and privacy tools already use automation to speed up responses. The key is integrating your existing systems (Google Drive, CRM, Helpdesk, etc.) so data gathering is much faster.

DSARify, for instance, provides such integrations out of the box, helping companies cut down manual work. Using it or building similar workflows (e.g., with connectors) lets teams focus on exceptions, not routine tasks.

Quick Scenario: 1-Click DSAR

Imagine a “1-click DSAR” feature:

You press “Investigate Request” in your tool.
The system automatically searches all connected data sources for matching user data.
It compiles a report and highlights any gaps.
You review, click “Deliver Response,” and the tool formats the report with encryption.

This vision is now achievable with workflow engines. Many businesses would happily pay for this level of convenience, as it drastically cuts response time.

Recommended KPIs to Track

To measure DSAR efficiency and tool impact, track metrics like:

Average response time: From request receipt to delivery.
Time per task: E.g., time spent searching data.
Number of requests handled per month: Growth here can signal process bottlenecks.
Compliance rate: Percentage of requests answered within deadline.
Customer satisfaction: (Optional) Feedback on the DSAR process.

Use these KPIs to continuously improve your DSAR process.

Sources: This guide references GDPR Article 15 requirements and industry best practices (e.g. GDPR compliance blogs). Insights are based on current privacy regulations and observed company practices.