GDPR Subject Access Requests (DSAR): How to Respond (2026)

A Data Subject Access Request (DSAR) is a formal request under Article 15 of Regulation (EU) 2016/679 (the GDPR) in which an individual asks an organisation to confirm whether it holds personal data about them and, if so, to provide a copy. Organisations covered by the GDPR must respond within one calendar month of receiving the request, at no charge, in a concise and intelligible form.

For background on the regulation as a whole, see what is GDPR. For the complete set of rights data subjects hold, including the right to erasure and the right to object, see GDPR data subject rights.

What Is a DSAR and Who Can Make One?

A DSAR is any communication, in any format, through which a natural person exercises the right of access under Article 15. The requester does not need to cite Article 15 or complete any form the organisation provides. "What information do you hold about me?" is a valid DSAR.

The right belongs exclusively to natural persons: living individuals whose personal data is being processed. Companies and other legal entities cannot make a DSAR. Deceased individuals are generally outside the GDPR's scope, though several EU Member States grant access rights to estate representatives or next of kin.

A request can be made directly or through an authorised representative such as a lawyer, or a parent or guardian acting for a child (whether a child can act alone depends on the child's maturity and capacity, EDPB Guidelines 01/2022, paragraph 84). Where a request arrives through a representative, the controller should verify authorisation before disclosing data, but that step does not extend the one-month clock.

The GDPR sets no form for an access request, so a request can be made orally or in writing, by email, post or other means, as long as it goes through a channel the controller provides or to a regular contact person rather than a random address (EDPB Guidelines 01/2022, paragraphs 52 to 55). Article 12(1) requires responses in clear and plain language; Recital 59 encourages controllers to make submission easy, including electronically. Online portals or dedicated email addresses are best practice but not legally required.

The right applies to all personal data a controller processes about the data subject in any format (electronic or paper, structured or unstructured, current or archival) subject to the exemptions discussed below.

Jurisdictional Scope

This article addresses the right of access under EU GDPR and EDPB guidance. It applies to EU/EEA-established organisations and to non-EU organisations that target goods or services at EU/EEA individuals or monitor their behaviour (Article 3(2)). The UK GDPR is similar but has diverged in detail since the Data (Use and Access) Act 2025; the differences are set out in the UK section below. Canadian, US, and other national analogues are outside scope.

---

What Information Must an Organisation Provide?

Article 15(1) and 15(3) require two distinct things: confirmation that processing is occurring (or that no data is held), and a copy of the personal data together with supplementary information.

The Copy of Personal Data

Article 15(3) requires "a copy of the personal data undergoing processing": the actual data, not a description. If a controller holds an email thread, account record, call recording, CCTV clip, or credit application containing the requester's personal data, the requester is entitled to a copy unless an exemption applies.

The CJEU held in FF v Österreichische Datenschutzbehörde (C-487/21, 4 May 2023) that the copy must be a faithful and intelligible reproduction of all the personal data, which can require copies of extracts from documents, whole documents or database extracts where that is essential for you to exercise your rights, taking account of the rights and freedoms of others. EDPB Guidelines 01/2022 on the right of access (version 2.1) add that a summary is not enough, but that the controller need not always reproduce the original documents (paragraph 23). The Article 15 copy right and the Article 20 data portability right are separate: portability applies only where the legal basis is consent or contract and processing is automated.

Where the controller processes large volumes of data, Recital 63 states the controller "should be able to request that, before the information is delivered, the data subject specify the information or processing activities to which the request relates." This is a practical management tool, not a right to refuse or require narrowing as a condition of responding.

Supplementary Information Required by Article 15(1)

Item (g) (the source of third-party data) is easy to overlook. If the controller purchased a marketing list or obtained data from a broker, it must disclose that source.

For third-country transfers, Article 15(2) requires disclosure of the specific safeguard: standard contractual clauses, an adequacy decision, binding corporate rules, or another Article 46 mechanism.

---

How Long Does an Organisation Have to Respond?

Article 12(3) requires a response without undue delay and in any event within one month of receiving the request. "Receiving" means the day the request reaches the organisation, not the day an employee reads it.

The Two-Month Extension

Article 12(3) permits a two-month extension where the request is complex or the controller has received numerous requests simultaneously. Whether a request is complex depends on the circumstances, such as how much data the controller processes, how hard it is to retrieve, and whether redaction or further work is needed to make it intelligible. The EDPB stresses that a large effort alone does not make a request complex (Guidelines 01/2022, paragraphs 163 and 164).

The extension notice must reach the data subject before the initial one-month period expires; a notice sent in month two is invalid. The notice must give the reasons for the delay (Article 12(3)).

When the Clock Starts

The clock starts on receipt, not on identity verification. Where the controller cannot identify the data subject without additional information, it may request the minimum necessary for identification; the clock is effectively paused during that period. Controllers cannot routinely demand government-issued photo ID from every requester as a delay tactic.

---

How Must the Response Be Delivered?

Article 12(3) requires information in writing or by other means, including electronic means where appropriate. Article 15(3) adds that where the request is made electronically, the response must be in a commonly used electronic format unless the data subject requests otherwise. PDF, Word, Excel, or a secure portal all qualify. A proprietary format requiring specialist software the requester is unlikely to have does not.

The response must meet Article 12(1) standards: concise, transparent, intelligible, and in clear and plain language. A data dump of raw database fields with no explanation of what each field means would likely fail the intelligibility requirement under EDPB guidance even if it contains all required data.

Where the data includes special categories under Article 9 (health records, racial or ethnic origin, biometric data) sending it over unencrypted email or a portal with inadequate access controls risks breaching the security duty in Article 32, and becomes a personal data breach if the data is intercepted or reaches the wrong person. Controllers should use encrypted transmission for any response containing Article 9 data.

---

Identity Verification: What Controllers Can and Cannot Require

Recital 64 states that controllers should use "all reasonable measures to verify the identity of a data subject who requests access." Verification is permitted but must be proportionate; controllers cannot request more information than necessary.

If the controller already holds the data subject's email address and the request arrives from that address, requiring government-issued photo ID is disproportionate. If an individual contacts an organisation for the first time by post claiming to be a customer, asking for account details to confirm identity is reasonable.

Controllers should not:

• Routinely require certified passport or driving licence copies when the request comes from an existing customer's registered email address.
• Require in-person verification unless a mistake in disclosure would cause serious harm.
• Use verification as a pretext to push responses past the one-month deadline.

---

Refusing a DSAR or Charging a Fee

The "Manifestly Unfounded or Excessive" Threshold

Article 12(5) is the only general ground for charging a fee or refusing a request outright (the rights of others under Article 15(4) and national restrictions under Article 23 can still limit what is disclosed): the request must be "manifestly unfounded or excessive, in particular because of their repetitive character." Repetition is an indicator, not a sufficient condition. A requester submitting a second DSAR six months after the first (because new processing has occurred or the first response was deficient) is not making a repetitive request under Article 12(5).

The burden is on the controller. Article 12(5) states explicitly: "the controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request." The CJEU has confirmed both sides of this. A request made for litigation or other reasons unrelated to data protection must still be answered, and the first copy is free (FT v DW, C-307/22, 26 October 2023). But even a first request can be refused as excessive where the controller proves it was made with an abusive intention, such as artificially creating the conditions for a compensation claim; a pattern of access requests followed by compensation claims against many controllers may be taken into account (Brillen Rottler, C-526/24, 19 March 2026). A pending Commission proposal, the Digital Omnibus (COM(2025) 837), would add abuse of the right of access for purposes other than data protection as an express ground and would require the controller to show only reasonable grounds to believe a request is excessive; it is not law.

Where the threshold is met, the controller has two options: charge a reasonable fee reflecting administrative costs, or refuse to act. On refusal, the Article 12(4) procedure applies: notify the data subject within one month, explain the reason, and inform them of their right to complain to a supervisory authority and seek judicial remedy.

Fees for Additional Copies

Article 15(3) separately permits a fee for "any further copies requested by the data subject," meaning additional copies of data already disclosed, not new DSARs about newly processed data. This provision is narrow and rarely applicable.

---

Exemptions: When Personal Data Can Be Withheld

Article 23 permits EU Member States to restrict the right of access in defined circumstances. National implementing rules vary significantly.

Common exemption categories:

Prevention, investigation, and prosecution of criminal offences. Most Member States allow law enforcement and regulatory bodies to withhold data where disclosure would prejudice an investigation.

National security and intelligence. Standard across Member State implementing laws.

Legal professional privilege. Communications between client and lawyer, or preparatory work for legal proceedings, may be withheld where Member State law preserves the exemption.

Confidential commercial information and trade secrets. A restriction may apply only to the extent strictly necessary to protect information that is the organisation's own, not the data subject's.

Employment and negotiations. Several Member States permit withholding where the employer's management or negotiation strategy would be disclosed.

Exemptions limit what data is disclosed, not whether the organisation must respond. Even where an exemption applies to part of the data, the organisation must respond within the deadline, acknowledge it holds data, disclose everything that is not exempt, and tell the data subject that some data was withheld and why.

UK Exemptions

The UK GDPR incorporates a broader exemption schedule through Schedules 2 to 4 of the Data Protection Act 2018, including a management forecasting and planning exemption where disclosure would prejudice the conduct of the business (Schedule 2, paragraph 22) and a negotiations exemption (paragraph 23).

---

Third-Party Data: Redaction, Not Refusal

When data held about the requester also includes personal data about other individuals (common in employment disputes, consumer complaints, and healthcare records) the correct approach under Article 15 and EDPB Guidelines 01/2022 is targeted redaction, not wholesale refusal.

The controller must provide the data subject's own personal data while redacting third-party personal data where disclosure would infringe those parties' rights. Factors to weigh:

• Whether the third party has consented to disclosure.
• Whether the requester already knows the third party's identity (if the third party is the requester's line manager named in a performance review, their name is not protected from disclosure in that document).
• In the UK, whether it is reasonable in all the circumstances to disclose the information without the third party's consent (Data Protection Act 2018, Schedule 2, paragraph 16).
• Whether the third-party information is so intertwined with the requester's data that effective redaction is impossible.

Recital 63 says that weighing the rights of others "should not be a refusal to provide all information to the data subject", so protecting third parties does not justify withholding entire documents when targeted redaction is feasible.

---

Common Mistakes in DSAR Responses

Missing the deadline without a valid extension. Controllers that treat one month as a target rather than a legal requirement face fines and enforcement notices.

Providing incomplete responses. Ignoring archived or backup systems, offline files, or data held by processors is a recurring deficiency. The response must cover all personal data the controller holds in any format.

Asking for excessive identification. Requiring government-issued photo ID from existing customers via known channels delays responses and may itself constitute a GDPR infringement.

Failing to identify the source of third-party data. Article 15(1)(g) is systematically omitted. Where data came from a broker, referral partner, or public source, that must be disclosed.

Redacting the requester's own data. A controller cannot redact the requester's personal data from their DSAR response on the basis that it also appears alongside third-party data.

Refusing on "manifestly unfounded" grounds without evidence. Refusing because the request is inconvenient, involves litigation, or requires significant work does not meet the Article 12(5) threshold (on litigation and other motives unrelated to data protection, FT v DW, C-307/22); the controller would have to prove something more, such as an abusive intention (Brillen Rottler, C-526/24).

Sending unencrypted special-category data. Transmitting Article 9 data over unencrypted email risks breaching the Article 32 security duty, and becomes a personal data breach if the data is intercepted or misdirected.

Ignoring verbal requests. The GDPR sets no form for an access request, so an oral request is valid (EDPB Guidelines 01/2022, paragraph 52). Controllers that only accept written or online-form DSARs risk missing legitimate requests; frontline staff need training to recognise and escalate them.

---

A Step-by-Step DSAR Response Workflow

Step 1: Recognise the request. Train all staff who interact with customers, employees, or the public to recognise DSARs regardless of the words used. Log the date of receipt immediately.

Step 2: Identify the data subject. Confirm whether the person can be identified from information provided. If not, request the minimum additional information needed. Document why it is required.

Step 3: Start the clock. Record the date of receipt. Set a 28-day internal deadline to allow preparation time before the one-month hard deadline.

Step 4: Search all systems. Search all databases, email archives, paper files, and records held by processors on your behalf. The search must be comprehensive.

Step 5: Assess for exemptions and third-party data. Review located data against applicable Article 23 national exemptions. For records also containing third-party personal data, determine whether targeted redaction is feasible.

Step 6: Consider extension. If the request is genuinely complex or you have received numerous simultaneous requests, document the decision to extend and send the extension notice before the one-month deadline.

Step 7: Prepare the response. Compile the data copy plus all Article 15(1)(a) to (h) supplementary information. Use a commonly used electronic format if the request was made electronically.

Step 8: Deliver securely. Use encrypted transmission for Article 9 data. Record what was sent, when, and in what format.

Step 9: Document the process. Under the Article 5(2) accountability principle, maintain a DSAR log: date received, identity verification steps, search methodology, data disclosed, exemptions applied, extension notice (if any), and date the response was issued.

Step 10: Handle follow-up requests. Treat any follow-up inquiry about completeness, or any request about newly generated data, on its own terms.

---

The UK Equivalent: Subject Access Requests Under the UK GDPR

Following Brexit, the UK retained the GDPR as the "UK GDPR" through the European Union (Withdrawal) Act 2018, supplemented by the Data Protection Act 2018. The core rules carry over (a one-month deadline, the information to be provided, free of charge by default, and the manifestly unfounded or excessive test), but the Data (Use and Access) Act 2025 changed the detail.

Key differences:

• Enforcement falls to the ICO, not an EU supervisory authority. Post-Brexit transfers from the EU to the UK require an adequacy decision (adopted by the European Commission on 28 June 2021 and renewed in December 2025) or an appropriate safeguard.
• The Data Protection Act 2018 Schedules 2 to 4 contain additional UK-specific exemptions: management forecasting, negotiations, and expanded law enforcement exemptions.
• Organisations operating in both the EU and UK may face concurrent obligations: a DSAR from an EU resident implicates EU GDPR; a DSAR from a UK resident implicates UK GDPR.
• Since 5 February 2026 the UK month runs from the "relevant time": the latest of receipt of the request, receipt of identity information the controller asked for, or payment of any fee (UK GDPR Article 12A, inserted by section 76 of the Data (Use and Access) Act 2025). Where the controller reasonably needs the requester to clarify the request, for example because it holds a large amount of information about them, the time until the reply does not count.
• The UK GDPR now limits the response to what the controller can provide based on a reasonable and proportionate search (Article 15(1A), inserted by section 78 and treated as in force from 1 January 2024).
• Since 19 June 2026 a data subject can also complain to the controller, which must acknowledge the complaint within 30 days (Data Protection Act 2018, section 164A).

For detailed ICO guidance, see ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/.

---

DSARs in the Employment Context

Employment generates more DSARs than almost any other relationship, particularly when employment is ending or has recently ended.

Litigation does not create an exemption. A threatened or active employment tribunal does not make a DSAR manifestly unfounded or excessive. In the EU, the CJEU confirmed in FT v DW (C-307/22) that the requester's purpose does not matter, unless the controller can prove an abusive intention (Brillen Rottler, C-526/24). Refusing an employment DSAR because litigation is anticipated will almost certainly generate an additional enforcement complaint.

Business confidentiality is narrow. Performance management documentation, disciplinary notes, and meeting records contain the employee's own personal data and must be disclosed. The controller can redact opinions about other employees but cannot redact the requester's own data.

Legal professional privilege applies to specific documents only. Where an employment lawyer advised the organisation in anticipation of litigation, those privileged communications may be withheld. Only those specific documents are covered, not entire HR file categories.

References and interview notes are personal data. References about an employee and interview scoring sheets are the employee's personal data and must generally be disclosed, subject only to targeted redaction of other individuals' information.

---

DSARs and Automated Decision-Making

Where the controller uses automated decision-making or profiling producing legal or similarly significant effects, Article 15(1)(h) requires the DSAR response to include "meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject."

In Dun & Bradstreet Austria (C-203/22, 27 February 2025) the CJEU held that Article 15(1)(h) entitles the data subject to an explanation, in concise, transparent, intelligible and easily accessible form, of the procedure and principles actually applied to their personal data to reach a specific result such as a credit profile. A controller that says the explanation would reveal trade secrets or third parties' data must give that material to the supervisory authority or court, which decides how much the data subject may see.

This applies in credit scoring, insurance underwriting, recruitment screening, and content moderation. A credit refusal triggered by an automated assessment without a meaningful explanation fails Article 15(1)(h); where the decision is based on a contract or explicit consent, Article 22(3) also requires a right to human intervention. The CJEU has held that a credit agency's score can itself be an automated decision when the lender draws strongly on it (SCHUFA, C-634/21, 7 December 2023).

---

DSAR Enforcement: What Regulators Have Found

In 2024, 30 supervisory authorities ran a coordinated action on the right of access (the EDPB's 2024 Coordinated Enforcement Action, report adopted 16 January 2025), and 1,185 controllers responded. Around two thirds of the participating authorities rated compliance as average to high. The recurring problems the report identified were:

• Lack of awareness about the scope of access to be provided
• Indefinite, excessive or inconsistent retention of data relating to access requests
• Lack of documented internal procedures
• Barriers that make it harder to exercise the right of access
• Inconsistent and excessive interpretations of the limits to the right of access
• Excessive use of the option to ask the requester to specify the request
• Information to requesters that is insufficiently detailed or tailored

National data protection authorities publish their own decisions on their websites; the EDPB lists its member authorities at edpb.europa.eu/about-edpb/who-we-are/members_en.

---

How the Right of Access Relates to Other GDPR Rights

The right of access typically precedes the exercise of other rights. A data subject who does not yet know what data is held often submits a DSAR first, then uses the disclosed information to decide whether to request rectification under Article 16, erasure under Article 17 (see GDPR right to be forgotten), restriction under Article 18, or objection under Article 21.

The right of access is distinct from the right to data portability under Article 20. Portability applies only where the legal basis is consent or contract and processing is automated; it requires data in a structured, machine-readable format. Article 15's right to a copy applies regardless of legal basis but has a less demanding format requirement.

A DSAR is also not a freedom-of-information request. FOIA and equivalent laws give rights to information held by public authorities about their public functions. A DSAR gives rights to personal data about the specific individual making the request. Both rights may arise simultaneously when a data subject contacts a public authority, and many public sector organisations process them in parallel.

Disclaimer: This article provides general legal information about the GDPR right of access (Article 15) and data subject access requests. It does not constitute legal advice and is not a substitute for advice from a qualified lawyer licensed in your jurisdiction. GDPR law and its interpretation by supervisory authorities and courts evolves continuously; the information in this article was verified as of October 2026. If you are responsible for DSAR compliance at an organisation, or if you are seeking to exercise your data subject rights, consult a data protection professional or lawyer qualified in the relevant EU Member State or UK jurisdiction.

Frequently Asked Questions

How long do you have to respond to a DSAR?

Article 12(3) requires a response without undue delay and in any event within one month of receiving the request. An extension of up to two further months is permitted where the request is complex or numerous requests have been received simultaneously, provided the controller notifies the data subject before the initial one-month deadline expires. Missing the one-month deadline without a valid extension is a breach of the GDPR.

Can you charge for a subject access request?

No, as a general rule. The only exception under Article 12(5) is where a request is manifestly unfounded or excessive, in which case the controller may charge a reasonable fee based on administrative costs or refuse the request. The burden of proving the request meets that threshold falls on the controller. Article 15(3) separately permits a fee for additional copies of data already disclosed, but not for new DSAR requests.

Can you refuse a DSAR?

Yes, in limited circumstances. Article 12(5) permits refusal only where the request is manifestly unfounded or excessive; the controller bears the burden of proof. Article 23 permits EU Member States to restrict the right of access for national security, criminal investigation, or professional privilege. On refusal, the controller must notify the data subject within one month, give reasons, and explain how to complain to a supervisory authority and seek judicial remedy.

What is the difference between a DSAR and the right to be forgotten?

A DSAR under Article 15 is a request to obtain a copy of personal data and understand how it is processed. The right to be forgotten (right to erasure) under Article 17 is a request for deletion in one of six defined circumstances. They are separate rights with separate grounds and procedures. In practice, many individuals submit a DSAR to understand what exists before deciding whether to request erasure. See GDPR right to be forgotten for detail.

Does a DSAR have to be in writing?

No. The GDPR sets no form for an access request, so an oral request is valid (EDPB Guidelines 01/2022, paragraph 52). Article 12(1) separately allows the controller to give information orally if you ask, provided your identity is proven by other means. Controllers that only accept DSARs through a formal written form or online portal risk missing verbal requests submitted by phone or in person. Frontline staff should be trained to recognise and escalate verbal DSARs.

What happens if an organisation does not respond to a DSAR?

Failing to respond within the applicable deadline breaches Article 12(3). The data subject can lodge a complaint with the competent supervisory authority in their EU Member State. Supervisory authorities can impose fines under Article 83; GDPR fines for violations of Articles 12 or 15 can reach up to 20 million euros or 4% of total worldwide annual turnover, whichever is higher.

Does a DSAR cover data held by the organisation's data processors?

Yes. The controller is responsible for all personal data it processes, including data processed on its behalf by third-party processors such as cloud providers, payroll services, or marketing platforms. The controller must instruct processors to assist with DSAR searches under the data processing agreements required by Article 28. The data subject submits the DSAR to the controller; the controller is responsible for retrieving data from processors and including it in the response.

Can an employer refuse an employment DSAR because of ongoing litigation?

No. Involvement in employment tribunal proceedings does not make a DSAR manifestly unfounded or excessive under Article 12(5). In the EU, the CJEU confirmed in FT v DW (C-307/22) that the requester's purpose does not matter, unless the controller can prove an abusive intention (Brillen Rottler, C-526/24). Legal professional privilege may apply to specific privileged communications, but it does not justify refusing or delaying the DSAR as a whole.

What format must a DSAR response be in?

Article 15(3) requires that where a request is made electronically, the response must be in a commonly used electronic format unless the data subject requests otherwise. PDF, Word, Excel, and secure portal access are all acceptable. The response must also satisfy Article 12(1): concise, transparent, intelligible, and in clear and plain language.

Is there a GDPR DSAR obligation for organisations outside the EU?

Yes, for organisations caught by Article 3(2). The GDPR applies to non-EU organisations that offer goods or services to EU/EEA individuals or monitor their behaviour. A US company selling to EU customers, or a global company whose app tracks EU users' location, must respond to DSARs from those individuals. Such organisations must also designate an EU representative under Article 27 unless an exemption applies.