Quick answer: When a customer submits a Data Subject Access Request (DSAR), a Data Protection Officer should verify the requester’s identity, locate all relevant personal data across systems, review it for third-party information or exemptions, compile a clear response, and deliver it within the legal deadline—typically one month under GDPR Article 15. Throughout the process, the DPO must document every step to demonstrate compliance.
Data subject access requests are no longer rare events. As privacy awareness grows and regulations like the GDPR, UK GDPR, and CCPA give individuals enforceable rights over their personal information, customers are increasingly asking companies: “What do you know about me?” For a Data Protection Officer (DPO), this question triggers a legal obligation with strict deadlines, specific procedural requirements, and real consequences for getting it wrong.
Handling a DSAR correctly isn’t just about compliance. It’s a trust-building exercise. Customers who see their request handled professionally and promptly are more likely to continue trusting a business with their data. Those who are met with delays, confusion, or incomplete responses may escalate to a regulator—or simply walk away.
This guide walks through exactly what a DPO should do when a customer requests access to their personal data, from the moment the request lands to final delivery and record-keeping.
What Is a Data Subject Access Request (DSAR)?
A DSAR is a formal request made by an individual asking an organization to confirm whether it holds personal data about them and, if so, to provide a copy of that data along with supporting information about how it’s processed. Under GDPR Article 15, this includes details such as the purposes of processing, the categories of data involved, who the data has been shared with, and how long it will be retained.
DSARs aren’t limited to GDPR-covered organizations. Similar rights exist under the California Consumer Privacy Act (CCPA), Brazil’s LGPD, and a growing list of global privacy laws. Regardless of jurisdiction, the core principle is the same: individuals have a right to know what personal data a company holds about them.
Step 1: Confirm the Request Is Valid and Verify Identity
The first thing a DPO from dpoasaservice.sg should do upon receiving a DSAR is determine whether it’s a legitimate request. Requests can arrive through email, a web form, a letter, or even verbally in some jurisdictions—there’s no requirement that it be submitted through a specific channel or labeled as a “formal” request.
Once a request is identified, the DPO must verify the requester’s identity before releasing any data. This step protects against fraudulent requests where a bad actor attempts to access someone else’s personal information. Verification methods might include:
- Requesting a government-issued ID that matches account details on file
- Confirming identity through existing account credentials (such as a login)
- Asking security questions tied to the account
Choose verification methods that are proportionate to the sensitivity of the data involved. Asking for excessive documentation can itself become a data protection issue, so the DPO should only request what’s reasonably necessary to confirm identity.
Step 2: Log the Request and Start the Clock
As soon as a valid DSAR is confirmed, the DPO should log it in a tracking system with the date received, the requester’s details, and the applicable deadline. Under GDPR, organizations generally have one calendar month to respond, though this can be extended by up to two additional months for complex or numerous requests, provided the requester is informed of the delay and the reasoning within the first month.
Missing this deadline isn’t a minor administrative slip. Supervisory authorities can issue enforcement action against organizations that consistently fail to meet DSAR timelines, and customers who feel ignored are more likely to file a complaint directly with a regulator.
Step 3: Locate All Relevant Personal Data
This is often the most labor-intensive part of the process. Personal data about a single individual can be scattered across CRM systems, email archives, marketing platforms, support ticket logs, HR systems (for employee-related requests), and third-party vendor platforms.
A well-prepared DPO works with IT and relevant department heads to run a comprehensive search covering every system where the organization stores personal data. This is where having a current data inventory or Record of Processing Activities (RoPA) pays off. Organizations that maintain an up-to-date map of where personal data lives can fulfill DSARs far more efficiently than those scrambling to figure out which systems to search each time a request arrives.
Step 4: Review the Data Before Releasing It
Once the data is gathered, the DPO must review it carefully before sending anything to the requester. This review step typically involves two key checks:
Removing or redacting third-party personal data. If the requested information includes personal data about other individuals—for example, an email thread that mentions a colleague or a support ticket referencing another customer—that third party’s information generally needs to be redacted or removed, unless they’ve consented to disclosure or an exemption applies.
Checking for applicable exemptions. Not all personal data must be disclosed. Information might be exempt if it’s protected by legal privilege, relates to an ongoing legal dispute, or would reveal trade secrets. The DPO should apply exemptions narrowly and be prepared to justify any withheld information if challenged.
Step 5: Compile a Clear, Organized Response
A DSAR response shouldn’t be a disorganized data dump. The goal is to present the information in a way that’s genuinely accessible to the requester, not just technically compliant. A strong response typically includes:
- A copy of the personal data held about the individual
- The purposes for which the data is being processed
- The categories of personal data involved
- Recipients or categories of recipients the data has been shared with
- The retention period, or criteria used to determine it
- Information about the individual’s other rights (such as rectification, erasure, or objection)
- The source of the data, if it wasn’t collected directly from the individual
Choose a format that’s genuinely readable for the individual—plain language summaries alongside raw data exports tend to work better than a spreadsheet dump with no context. If the request was submitted electronically, the response should generally be provided in a commonly used electronic format unless the individual requests otherwise.
Step 6: Deliver the Response Securely
Personal data is sensitive by definition, so the method of delivery matters. Sending a DSAR response via unencrypted email or an unsecured file-sharing link can itself create a data breach. DPOs should use secure, encrypted channels for transmission and confirm the response is going to the verified individual—not an old email address or a third party who submitted the request on someone else’s behalf without proper authorization.
Step 7: Document Everything
Throughout the entire process, the DPO should maintain a clear record of:
- When the request was received and verified
- What searches were conducted and where
- Any redactions or exemptions applied, and the reasoning behind them
- The date and method of the final response
This documentation serves two purposes. It demonstrates accountability under GDPR’s broader principle of being able to show compliance, not just achieve it. It also protects the organization if the requester later disputes the completeness of the response or escalates the matter to a supervisory authority.
What Happens If the Deadline Is Missed or the Request Is Refused?
Sometimes a DSAR can’t be fulfilled within the standard timeframe, or an organization has valid grounds to refuse it entirely—for instance, if the request is manifestly unfounded or excessive. In these cases, the DPO must notify the individual in writing, explain the reasons for the delay or refusal, and inform them of their right to lodge a complaint with a supervisory authority and seek a judicial remedy. Silence is never an acceptable response to a DSAR, even when refusal is justified.
Turning DSAR Handling Into a Repeatable Process
Choose a documented, repeatable DSAR workflow if your organization wants to avoid treating every request as a fire drill. The most effective DPOs build a standard operating procedure that covers identity verification, system-by-system search protocols, review templates, and secure delivery methods—so that each new request follows a proven path rather than starting from scratch.
Investing in a current data inventory, training customer-facing staff to recognize and escalate DSARs promptly, and running periodic internal audits of DSAR response times all help an organization stay ahead of its obligations. The result isn’t just regulatory compliance. It’s a stronger foundation of trust between the business and the people whose data it holds.
Frequently Asked Questions
How long does a Data Protection Officer have to respond to a DSAR?
Under GDPR, organizations must respond within one calendar month of receiving a valid request. This can be extended by up to two further months for complex or multiple requests, provided the individual is notified of the extension and the reason within the first month.
Can a company charge a fee for responding to a DSAR?
Generally, no. DSARs must be fulfilled free of charge. An organization may charge a reasonable administrative fee only if the request is manifestly unfounded, excessive, or if the individual asks for additional copies of data already provided.
What should a DPO do if a DSAR includes another person’s personal data?
The DPO should redact or remove third-party personal data from the response unless that third party has consented to its disclosure or a legal exemption applies. The requester’s own data should still be provided in full.
Can an organization refuse a DSAR entirely?
Yes, but only on limited grounds, such as when the request is manifestly unfounded or excessive. If refused, the organization must inform the individual of the reasons and their right to complain to a supervisory authority.
What are the risks of failing to respond to a DSAR properly?
Organizations that miss deadlines or provide incomplete responses risk regulatory complaints, potential fines, and reputational damage. Consistent DSAR mishandling is also a common trigger for broader regulatory investigations into an organization’s data protection practices.
