DSAR (data subject access request)
A person’s request to see, copy, correct or delete the data a company holds about them; under GDPR it must be answered within one month.
Under GDPR Article 15 the person gets a copy of their data plus where it came from, why it is used, who receives it and how long it is kept; the first copy is free. The deadline is one month, extendable by two more for complex or numerous requests. California and other US states have similar rights, usually with 45 days to respond. The hard part is technical: finding one person across the database, logs, analytics, email tools, backups and AI providers.
Related terms
- GDPR: The EU regulation on personal data: lawful basis, minimal data, user rights and breach reporting, for anyone handling EU residents’ data.
- CCPA and CPRA (California privacy law): California’s consumer privacy law: rights to know, delete, correct and opt out of the sale or sharing of personal data, browser signals included.
- GDPR lawful basis (consent vs legitimate interest): Every use of personal data under GDPR needs one of six legal bases; consent is only one of them, and often not the best one.
- US state privacy laws: With no federal privacy law, about 20 US states have their own comprehensive privacy laws in effect in 2026, each with its own thresholds and details.
