Data subject access request (DSAR)
Also known as: DSAR, SAR, subject access request, right of access, data access request, right to know
A data subject access request (DSAR) is a request from an individual asking an organization for a copy of the personal data it holds about them, along with details on how it's used and shared.
Most modern privacy laws, including GDPR, PIPEDA, and Quebec's Law 25, grant this right. While it sounds like a simple customer service task, a single DSAR can force a company to search email, backups, and dozens of systems, which is why it's become a favourite tactic in employment disputes.
Data subject access request (DSAR), explained at three levels
At home
You can ask almost any company, 'What information do you have about me?' and they generally have to tell you. That's a data subject access request. You might find out what they store, why, and who they've shared it with.
At work
When a customer or employee asks what data your organization holds about them, you usually have a legal deadline to respond, often 30 days. Having a simple process, such as a form and a checklist of systems to search, makes these requests much easier to handle.
At home
You don't usually need a special form. An email saying you're making an access request under the relevant law is often enough. The company may ask you to verify your identity first, which protects you from someone else requesting your data.
At work
Responding to a DSAR means verifying identity, searching all relevant systems (CRM, email, HR files, logs, backups where practical), redacting third-party information, and providing the data in an understandable format with required details, such as purposes, recipients, and retention periods. Missing deadlines is one of the most common causes of regulatory complaints.
At home
DSARs are sometimes used strategically, such as by employees in disputes who want to see internal emails about them before litigation. In my view, that's a legitimate use of a legal right, even if it frustrates employers. The right exists precisely because people often can't know what's being said or decided about them otherwise.
At work
At scale, DSAR handling depends on a data inventory linked to identifiers, search tools that work across unstructured data like email and chat, redaction workflows, and audit trails. Organizations can sometimes refuse or charge for 'manifestly unfounded or excessive' requests, but the bar is high. Automating discovery is often cheaper than handling requests manually once volume grows.
Real-world examples
At home
Jerome kept getting ads that seemed to know about his recent medical appointments. He sent a DSAR to a health app he used and received a file showing the data it held, including a list of advertising partners it had shared information with. He deleted his account.
At work
Lena is the privacy coordinator at a mid-sized Ottawa insurance broker. After receiving three DSARs in one month, she built a checklist of the twelve systems that held customer data and set up a shared tracker for deadlines. Response time dropped from three weeks to five days.
Common confusions
- Companies can charge you for a copy of your data. — Under GDPR, access is generally free. Some laws allow minimal fees in limited cases, but charging is the exception.
- A DSAR gives you copies of every document mentioning you. — You're entitled to your personal data, not necessarily entire documents. Third-party information may be redacted.
- Only customers can make DSARs. — Employees, job applicants, former customers, and anyone whose data the organization holds can make one, subject to local law.
For analysts
Count your DSARs and measure response times. I'd treat a rising DSAR volume as an early warning sign, since it often signals customer distrust or an emerging employment issue before it shows up anywhere else.
History & origin
Rights of access appeared in early data protection laws in the 1970s and 1980s and were codified in the EU's 1995 Data Protection Directive. GDPR, applying from May 2018, strengthened the right in Article 15, removed fees in most cases, and set a one-month deadline, extendable by two months for complex requests. Canada's PIPEDA has provided an access right since 2001, generally with a 30-day response window, and Quebec's Law 25 also uses 30 days. The California Consumer Privacy Act added a 'right to know' in 2020. The UK's 2025 data reform clarified that organizations only need to carry out 'reasonable and proportionate' searches. In my opinion, DSARs are the clearest test of whether a company actually knows where its data lives.