Data Subject Access Request (DSAR)

The foundational principle empowering individuals to obtain confirmation of whether their personal data is being processed. The response must include:

• The purposes of processing
• The categories of personal data concerned
• The recipients or categories of recipients
• The envisaged retention period
• The existence of automated decision-making, including profiling

Before fulfilling a DSAR, the controller must verify the identity of the requestor to prevent unauthorized data disclosure. This often requires multi-factor authentication or requesting additional information without collecting excessive new data. The standard is 'reasonable means'—balancing security with accessibility.

Organizations must respond without undue delay and at the latest within one month of receipt. This clock can be extended by two further months for complex or numerous requests, but the data subject must be informed of the delay within the first month. Failure to meet deadlines triggers regulatory liability.

The only grounds for refusal or charging a fee. A request is manifestly unfounded if the individual has no genuine intent to exercise their right (e.g., malicious intent). It is excessive if it overlaps with a recent, identical request. The burden of proof lies with the data controller.

The response must be provided in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. If the request was made electronically, the information should be provided in a commonly used electronic format (e.g., JSON, CSV) unless otherwise specified by the user.

The right of access must not adversely affect the rights and freedoms of others. This requires redacting personal data of third parties, trade secrets, or intellectual property from the response package. Automated systems must implement entity recognition to mask co-mingled data before disclosure.