Data subject access request (DSAR)
Also known as: DSAR, SAR, subject access request, right of access, data access request, right to know
A data subject access request (DSAR) is a request from an individual asking an organization for a copy of the personal data it holds about them, along with details on how it's used and shared.
Most modern privacy laws, including GDPR, PIPEDA, and Quebec's Law 25, grant this right. While it sounds like a simple customer service task, a single DSAR can force a company to search email, backups, and dozens of systems, which is why it's become a favourite tactic in employment disputes.
Data subject access request (DSAR), explained at three levels
At home
Think of a DSAR as asking a company to open its filing cabinet and show you your folder. You can ask what personal information it holds about you, why it uses it, where it came from, who it shared it with, and how long it will keep it. In most cases the company must answer within a set deadline and give you a copy.
At work
A DSAR is a request from an individual to see the personal data an organization holds about them, a right found in GDPR, PIPEDA, Quebec's Law 25, and many other laws. The organization must confirm whether it processes the person's data, provide a copy, and explain how it's used. Businesses care because deadlines are strict, often 30 days, and finding everything takes real effort.
At home
Making a request is usually simple. A clear email saying you want access to your personal data is often enough, with no special form required. The company can ask you to verify your identity, so a stranger can't get your file. Under GDPR it has one month to respond, extendable for complex cases, while under PIPEDA and Law 25 it's generally 30 days. The response is usually free.
At work
A DSAR runs through a pipeline. First, log the request and start the clock. Then verify identity proportionately, search every system that may hold the person's data, such as CRM, email, HR files, chat, logs, and backups where practical, and gather the results. Next, redact information about other people and anything privileged. Finally, deliver a clear copy with the required details: purposes, recipients, sources, retention periods, and how to complain.
At home
DSARs are sometimes used strategically. Employees in disputes request them to see internal emails and notes about them before deciding whether to sue, because a DSAR can reveal documents faster and more cheaply than court disclosure. While employers find this frustrating, in my view it's a legitimate use of a legal right. The right exists precisely because people often can't otherwise know what is being said or decided about them.
At work
At scale, DSAR handling depends on a data inventory linked to identifiers, search tools that reach unstructured data like email and chat, redaction workflows, and audit trails. Under GDPR, organizations can refuse or charge for 'manifestly unfounded or excessive' requests, but the bar is high and the burden of proof sits with them. Exemptions also differ by law, such as legal privilege or confidential commercial information. Once volume grows, automating discovery is usually cheaper than searching manually.
Real-world examples
At home
Jerome kept getting ads that seemed to know about his recent medical appointments. He sent a DSAR to a health app he used and received a file showing the data it held, including a list of advertising partners it had shared information with. He deleted his account.
At work
Lena is the privacy coordinator at a mid-sized Ottawa insurance broker. After receiving three DSARs in one month, she built a checklist of the twelve systems that held customer data and set up a shared tracker for deadlines. Response time dropped from three weeks to five days.
Common confusions
- Companies can charge you for a copy of your data. — Under GDPR, access is generally free. Some laws allow minimal fees in limited cases, but charging is the exception.
- A DSAR gives you copies of every document mentioning you. — You're entitled to your personal data, not necessarily entire documents. Third-party information may be redacted.
- Only customers can make DSARs. — Employees, job applicants, former customers, and anyone whose data the organization holds can make one, subject to local law.
For analysts
Count your DSARs and measure response times. I'd treat a rising DSAR volume as an early warning sign, since it often signals customer distrust or an emerging employment issue before it shows up anywhere else.
History & origin
Rights of access appeared in early data protection laws in the 1970s and 1980s and were codified in the EU's 1995 Data Protection Directive. GDPR, applying from May 2018, strengthened the right in Article 15, removed fees in most cases, and set a one-month deadline, extendable by two months for complex requests. Canada's PIPEDA has provided an access right since 2001, generally with a 30-day response window, and Quebec's Law 25 also uses 30 days. The California Consumer Privacy Act added a 'right to know' in 2020. The UK's 2025 data reform clarified that organizations only need to carry out 'reasonable and proportionate' searches. In my opinion, DSARs are the clearest test of whether a company actually knows where its data lives.