Data Subject Access Requests – DSARs – land in inboxes far more often than most privacy teams expect, and mishandling one is one of the fastest ways to turn a routine GDPR obligation into a regulatory complaint. This article walks through what a DSAR actually requires, the timelines that apply under GDPR and CCPA, and the operational mistakes that trip up even well-resourced compliance teams.
What Counts as a Valid Data Subject Access Request
Under Article 15 GDPR, any individual can ask an organization to confirm whether it processes their personal data and, if so, to provide a copy of it along with details like processing purposes, recipients, and retention periods. The request doesn’t need to say “DSAR” or cite a specific article. A customer emailing “send me everything you have on me” to a support inbox is a valid request, and the 30-day clock starts the moment it’s received – not when someone in legal finally sees it.
This is where a lot of organizations lose days without realizing it. A request submitted through a contact form on a Saturday, or buried in a chatbot transcript, still counts. A seasoned GRC lead builds intake logging that timestamps every channel – email, web form, phone, social media DM – because the regulator measures the deadline from first contact, not from internal triage.
The 30-Day Clock and When It Can Be Extended
GDPR gives controllers one calendar month to respond, extendable by two additional months for complex or numerous requests – but the extension must be communicated to the requester within the original 30 days, with a reason. Silence past day 30 is itself a violation, even if the substantive answer arrives on day 45.
CCPA works differently: California-covered businesses have 45 calendar days, with one 45-day extension permitted, again requiring notice to the consumer before the first deadline expires. Mixing up the two frameworks is a common error for companies serving both EU and California audiences – applying the CCPA 45-day window to an EU resident’s request has resulted in documented enforcement action, including a 2021 CNIL fine tied partly to delayed access response handling. For a broader view of how these regimes interact across a single website, see how CCPA compliance for US-facing websites is typically structured alongside GDPR obligations.
Verifying Identity Without Over-Collecting Data
A DSAR handler has to confirm the requester is who they claim to be, without turning verification into its own privacy problem. Asking for a copy of a government ID when the person only ever gave you an email address and a shipping address is disproportionate – match verification effort to the sensitivity and format of data already held. For an account with login credentials, requiring authentication through the existing account is usually sufficient. For anonymous form submissions, a confirmation email loop with a time-limited token works for most low-risk requests.
Overzealous verification is itself a compliance risk. The UK ICO has explicitly flagged requests for excessive ID documents as an obstruction tactic, and regulators read it as an attempt to discourage requesters rather than genuine security practice.
Step-by-Step Handling Process
A repeatable workflow keeps response times predictable even when request volume spikes after a data breach disclosure or a press mention.
1. Log the request with timestamp, channel, and requester contact details within 24 hours of receipt.
2. Verify identity proportionate to data sensitivity, and pause the clock only where local law explicitly permits it (GDPR does not allow pausing for verification delays caused by the controller).
3. Query every system that might hold the individual’s data – CRM, marketing automation, support ticketing, backups, and any subprocessor named in a Data Processing Agreement.
4. Compile the response: categories of data, processing purposes, recipients, retention period, and the data itself in a portable format such as CSV or PDF.
5. Deliver securely – encrypted email or a authenticated portal, never an unencrypted attachment to a personal email address.
Step three is where most delays originate. A mid-sized SaaS company with data spread across Salesforce, Intercom, a data warehouse, and three ad-tech pixels cannot answer a DSAR accurately without a current inventory of where personal data actually lives, which is exactly what a maintained Records of Processing Activities register is meant to support.
Common Mistakes That Trigger Complaints
Three patterns show up repeatedly in DPA enforcement summaries and complaint filings. First, treating the DSAR as purely a legal task and routing it only to counsel – by the time legal loops in engineering to pull data from production systems, a week has already passed. Second, providing a partial export because nobody checked the shadow IT tools marketing signed up for outside the approved vendor list – a request answered from the CRM alone while ignoring a third-party email platform is technically an incomplete response. Third, responding on time but without the required context, such as omitting the list of third parties data was shared with, which under GDPR Article 15(1)(c) is not optional.
A related myth worth retiring: many teams believe they can simply refuse “manifestly unfounded or excessive” requests at their own discretion. Regulators set a high bar for that exemption – repeated near-identical requests from the same person within a short window might qualify, but a single detailed request rarely does, even if it’s inconvenient to fulfill.
Assigning Ownership Inside the Organization
Response quality improves sharply once one role owns the end-to-end process rather than treating it as an ad hoc task for whoever picks up the ticket. In organizations without a dedicated privacy team, this usually falls to whoever holds DPO-equivalent responsibilities, working with a named contact in each department that touches customer data – support, sales ops, and engineering at minimum.
Frequently Asked Questions
Can a company charge a fee for responding to a DSAR?
Under GDPR, the first copy must be provided free of charge; a reasonable administrative fee is only permitted for manifestly excessive or repetitive requests. CCPA similarly expects no charge for up to two requests per 12-month period.
What happens if the deadline is missed?
Missing the deadline without communicating an extension is a reportable violation. It doesn’t automatically trigger a fine, but it becomes documented evidence of process failure if the requester escalates to a supervisory authority, and repeated late responses tend to draw closer regulatory scrutiny.
Does a DSAR include data held by third-party processors?
Yes. The controller remains responsible for retrieving and disclosing data processed on its behalf by vendors, which is why the Data Processing Agreement with each vendor should specify a maximum turnaround time for supporting a DSAR – ideally well under the regulatory deadline to leave room for compilation.
Handling DSARs well is less about legal knowledge and more about operational readiness – knowing where data lives before the request arrives, not scrambling to find out after day 20 of a 30-day window.