Data subject access request (DSAR)
Definition
A request by an individual to a controller to exercise a data protection right, most often access to a copy of their personal data and details of its processing.
A DSAR is the operational side of data subject rights. Under GDPR Arts. 12 and 15, a person asking for access is entitled to confirmation that their data is processed, a copy of it and information on purposes, categories, recipients, retention, sources, rights and any automated decision-making. The controller must answer without undue delay, generally within one month, extendable in complex cases, and usually free of charge. Requests do not need a special form or wording, and identity checks must be proportionate.
The LGPD (Arts. 18 and 19) requires confirmation of existence or access either immediately in simplified form or within a set period for a complete declaration, and the request is free. Under the California CCPA/CPRA, consumers have comparable "right to know" requests.
A mature DSAR process has a single intake channel, identity verification, a data map to locate records, legal review for third-party data and an audit trail. In AI contexts, it should cover prompts, outputs and inferences about the person.
Where this term is assessed
Assessed in the Data Protection & AI Professional (DPAI), domain 2: Data subject rights and requests.
Primary sources
- GDPR Arts. 12 and 15
- LGPD Arts. 18-19
- EDPB Guidelines 01/2022 on the right of access