DSAR (Data Subject Access Request): Deadlines, Process and a Tracking Template

TL;DR

• A DSAR (data subject access request) is a request from a person to see the personal data an organization holds about them. Under the GDPR you must respond within one month of receipt, extendable by two further months for complex or numerous requests (gdpr-info.eu).
• Under the CCPA and CPRA, a business must confirm receipt of a request to know, delete or correct within 10 business days and respond within 45 calendar days, extendable once to 90 days with notice (cppa.ca.gov).
• Most missed deadlines are not legal mistakes. The request arrived in a sales inbox, a support ticket or a chat message, nobody recognized it, and the clock ran with no owner.
• Sentra reads email, chat and meetings alongside CRM and HRIS records, spots an access or deletion request wherever it lands, and raises it to the privacy owner with the deadline and the evidence. A named person approves before anything goes out.

What is a DSAR?

A DSAR, or data subject access request, is a request by an individual to confirm whether an organization processes their personal data and to receive a copy of it. The GDPR calls this the right of access, set out in Article 15. The UK ICO calls it a subject access request (SAR). California's CCPA calls the equivalent a request to know.

The term is often used loosely for every data subject request, including deletion and correction. This guide covers access and deletion.

A valid request does not need a form. The ICO states that requests can be made "verbally or in writing, including via social media," and that a person "does not need to use a specific form of words, refer to legislation or direct the request to a specific contact" (ico.org.uk). A customer who replies to a newsletter with "send me everything you have on me" has made a DSAR. So has an ex-employee who asks HR in a chat message for their file.

What a person is entitled to receive

Under Article 15, the response must include a copy of the personal data and these details (gdpr-info.eu):

• The purposes of the processing.
• The categories of personal data concerned.
• The recipients or categories of recipient, including any in third countries.
• How long the data will be stored, or the criteria used to decide.
• The right to request rectification, erasure or restriction, or to object.
• The right to complain to a supervisory authority.
• The source of the data, if it was not collected from the person.
• Any automated decision-making, including meaningful information about the logic involved.

The first copy is free. Article 12(5) allows a reasonable fee or a refusal only where a request is "manifestly unfounded or excessive," and the controller carries the burden of proving it (gdpr-info.eu). The copy must not adversely affect the rights and freedoms of others, which is why third-party names in emails are often redacted.

DSAR deadlines by law

The DSAR deadline is the part most teams get wrong, because the clock starts when the request reaches anyone in the organization, not when it reaches the privacy team.

How to count the GDPR month

The ICO gives the clearest counting rule. The month starts on the day you receive the request, even if that day is a weekend or public holiday, and ends on the matching date of the next month. A request received on 3 September is due on 3 October. If the next month has no matching date, the deadline is the last day of that month, so a request received on 31 March is due on 30 April. If the deadline falls on a weekend or bank holiday, it moves to the next working day (ico.org.uk).

If you need ID or proof of a third party's authority, the clock starts once you have it. If you genuinely need to clarify what the person wants, the time limit "pauses on the day you request it and resumes the day after you receive it" (ico.org.uk). Neither is a delay tactic. Article 12(6) allows identity checks only where you have "reasonable doubts" about who is asking (gdpr-info.eu).

The ICO notes that its time limits guidance is under review following the Data (Use and Access) Act, so check the current version before you rely on edge cases.

If you refuse

If you decide not to act on a request, Article 12(4) requires you to tell the person, without delay and within one month, why not, and that they can complain to a supervisory authority and seek a judicial remedy (gdpr-info.eu).

What a miss can cost

Infringements of the data subject rights in Articles 12 to 22 fall in the higher GDPR fine tier: up to EUR 20 million or, for an undertaking, up to 4% of total worldwide annual turnover of the preceding financial year, whichever is higher (gdpr-info.eu). Under the CCPA, the Attorney General and the California Privacy Protection Agency can take enforcement action, and consumers can file complaints with the agency (oag.ca.gov).

The DSAR response process, step by step

1. Recognize and log the request on the day it arrives. Record the date of receipt, the channel, the exact wording and who received it. The received date sets the deadline, so log it as received by the organization, not by the privacy team.

2. Assign one owner. Name a person, not a mailbox. The owner holds the deadline and signs off the response.

3. Calculate the deadline and the acknowledgment date. Apply the rule for the person's jurisdiction. For a California resident, the 10 business day confirmation is a separate, earlier deadline.

4. Verify identity only if you have reasonable doubt. Use the least intrusive check that works, such as confirming details you already hold. Note that under the CCPA the 45 days begin on the day of receipt "regardless of time required to verify the request," under section 7021 of the regulations (cppa.ca.gov).

5. Clarify scope only if needed. If the person holds a lot of data with you, you can ask which information they want. Record the date you asked and the date they answered.

6. Search every system that holds personal data. The ICO expects "a reasonable and proportionate search" (ico.org.uk). That usually means CRM, support desk, billing, HRIS, email, chat, call recordings, marketing tools, product databases and backups. Your record of processing activities is the map.

7. Review and redact. Remove third-party personal data where disclosure would affect their rights, and apply any exemptions with a written reason.

8. Compile the response. Include the copy of the data plus every Article 15 detail. If the request came electronically, respond in a commonly used electronic format.

9. Approve and send securely. The owner and, where needed, legal review the pack. Send through a secure channel and record the date sent.

10. Close and keep the record. Store the request, the deadline calculation, any extension notice, the search log and the response. This file is your evidence if a regulator asks.

Handling deletion requests

A deletion request (right to erasure under GDPR Article 17, right to delete under the CCPA) has a different shape from an access request. Under the GDPR you must erase personal data "without undue delay" where one of the listed grounds applies, for example where the data is no longer necessary for its original purpose, consent is withdrawn and no other legal basis exists, or the data was processed unlawfully (gdpr-info.eu). The Article 12 one-month limit still governs when you must tell the person what action you took.

Erasure is not absolute. Article 17(3) lists exceptions, including compliance with a legal obligation that requires processing and the establishment, exercise or defence of legal claims (gdpr-info.eu).

Deletion also travels. Article 19 requires you to tell each recipient of the data about the erasure unless that proves impossible or involves disproportionate effort, and to tell the person who those recipients are if they ask (gdpr-info.eu). Under the CCPA, a deletion request also reaches the business's service providers (cppa.ca.gov). A deletion is not complete until the CRM, the email platform, the data warehouse and every processor have acted.

If you run AI tools or agents over company data, add them to the deletion checklist. Any copy, cache or memory that holds the person's data is in scope. See AI agent permissions for how access follows the source.

DSAR tracking template

Use one row per request. A shared spreadsheet works for a few requests a month. Above that, a ticket queue with these fields works better.

Add a status rule: any open request with fewer than 7 days to its deadline goes red and to the owner's manager.

Worked example: the request nobody logged

Assumptions: a UK customer, UK GDPR applies, no ID doubts, no clarification needed.

On Monday 14 September 2026 a customer replies to a renewal email from their account executive: "Please delete my details and tell me what you hold on me." That is both an erasure request and an access request. The account executive goes on leave the next day. The message sits in their inbox.

The deadline is 14 October 2026, one calendar month from the day of receipt. On 9 October a colleague covering the account reads the thread and forwards it to the privacy lead. Five days remain to search eight systems, apply the tax-record exception to invoices, notify the email platform and the analytics vendor, and send the response.

An extension does not rescue this. Article 12(3) allows two further months only "where necessary, taking into account the complexity and number of the requests," and only if you tell the person within the first month with reasons (gdpr-info.eu). A request that sat unread for 25 days is not complex. It was lost.

The same pattern under the CCPA is tighter at the front. A California customer's deletion request received on Thursday 1 October 2026 needs a confirmation of receipt within 10 business days, which is 15 October assuming no holidays, and a substantive response within 45 calendar days (cppa.ca.gov). A request found on day 12 has already missed its first deadline.

Common DSAR mistakes

• Starting the clock when privacy sees it. The month runs from receipt by the organization. A request in a sales rep's inbox is received.
• Ignoring requests that do not say "DSAR." No form of words is required. Train frontline teams to recognize "what do you hold on me" and "delete my account."
• Asking for ID by default. Identity checks need reasonable doubt. Routine passport requests slow you down and may breach data minimization.
• Using the extension as a buffer. Extensions require complexity or volume and notice within the first month.
• Searching only the CRM. Email, chat, call recordings, backups and AI tool memory hold personal data too.
• Deleting in one system. Erasure must reach recipients and processors. Track each one.

The underlying failure is the same one behind most missed obligations: the commitment exists in a message, and no system of record knows about it. The contract compliance guide covers the same gap for signed terms, and the employee offboarding checklist covers the leaver who sends a SAR on their last day.

How Sentra catches this automatically

Privacy tools manage a DSAR well once it is in the queue. The failure happens before that, when the request lands in a place the privacy team does not watch.

Sentra reads email, chat and meetings alongside the systems of record: CRM, HRIS, support and ERP. It recognizes an access or deletion request wherever it arrives, in a reply to a renewal email, a support thread or a chat message to HR. It joins that message to the record of who the person is, a customer in the CRM or a former employee in the HRIS, and works out which law likely applies and when the clock started.

It then raises the request to the privacy owner with the evidence: the original message, the date received, the calculated deadline, and the systems that hold the person's data. If an open request is approaching its deadline with no response, Sentra raises that too. A named person approves anything Sentra raises before it reaches anyone else, and Sentra never sends a response or deletes data on its own.

Every answer respects each source's existing permissions, so the privacy lead sees the request without Sentra exposing anything a person could not already see. Sentra holds SOC 2 Type II and ISO 27001 and runs in the cloud, an isolated VPC or air-gapped on-prem. It works alongside your privacy platform and ticketing tools rather than replacing them.

To see how Sentra would catch a lost request in your own inboxes, book a demo.

FAQ