Whenever someone creates an account, buys something, or contacts a business online, the business may collect and use their personal information.
If a person wants to know what information a business has about them, they can make a DSAR (Data Subject Access Request).
For businesses, handling a request can involve checking the person’s identity, searching different systems for their information, reviewing the records, protecting other people’s information, and securely sending the response. Here in this blog, you will learn about the DSAR full form and what it means in different regulations.
What is a DSAR full form?
DSAR full form is Data Subject Access Request. Through this a person can ask a company to tell them what personal details it holds about them and what it is doing with that information.
For example, an online retailer can store your name, contact details, purchase history, support conversations, marketing preferences, and other personal information across different systems.
It allows you to request access to relevant information, subject to the privacy law that applies. The rules and rights may be different in each country. For example, the UK GDPR uses “data subject” while India’s DPDP Act refers to individuals as Data Principal.
What Is the Difference Between DSAR, DSR and SAR?
All these terms look similar, but they are not completely the same:
| Terms | Meaning | Typical Scope |
| DSAR | Data Subject Access Request | Primarily focused on accessing personal data |
| DSR | Data Subject Request | Broader term covering different privacy-rights requests |
| SAR | Subject Access Request | Common term for an access request, particularly in UK privacy context |
The terminology matters less than the specific right being exercised and the law that applies to the organization and individual.
What Can Someone Request Through a DSAR?
Because regulations differ by country, there is no single answer that applies everywhere.
In general, an individual may seek information such as:
- Personal information held about them
- Details about how their data is used
- Purpose of processing the personal information
- Information about recipients or third parties
- Relevant retention information
- Other supplementary information required by the applicable law
Under the UK GDPR, for example, the right of access includes confirmation that personal information is being processed, a copy of the personal information and supplementary information.
Data Subject Access Requests under GDPR
The GDPR provides a right of access under Article 15.
The right includes confirmation of whether personal data concerning the individual is being processed and, where applicable, access to that personal data and specified supplementary information.
The supplementary information may include:
- Reason behind the processing
- Categories of personal data
- Recipients or categories of recipients
- Retention-related information
- Information about the individual’s rights
- Information about the source of the data where applicable
GDPR also requires communications concerning data subjects’ rights to be provided in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. So, organizations need clear rules and steps to handle these requests.
Data Subject Access Requests Under India’s DPDP Act
India’s Privacy framework uses different terminology. The Digital Personal Data Protection Act, 2023 refers to individuals as Data Principals and organizations as Data Fiduciaries.
This means organizations can use “DSAR” as an operational term, but should use the DPDP Act’s terms (Data Principal, Data Fiduciary) in legal and customer-facing communication.
Rights of Data Principals: Sections 11 to 14 of the DPDP Act give Data Principals four main rights: access to information about their data (Section 11), correction and erasure (Section 12), grievance redressal (Section 13), and nomination of another person to act on their behalf (Section 14). The Act does not use the term “DSAR,” but these rights are how such requests work in practice.
What is the Data Subject Access Request response timeline?
There is no single worldwide DSAR deadline.
The applicable deadline depends on the privacy law and circumstances of the request.
For example, under the current ICO guidance for UK GDPR subject access requests, organizations generally need to respond without undue delay and within one month. In certain complex cases, or where multiple requests have been made by the same person, the period can be extended by up to two additional months.
Organizations should therefore avoid creating a universal internal rule such as:
Instead, the workflow should determine
- Which law applies
- When did the relevant clock start
- Is identity verification required?
- Is clarification reasonably necessary?
- Does the applicable law permit extension?
When can the organization refuse or request?
A DSAR does not always result in unrestricted disclosure:
Depending on the applicable law, an organization may be able to withhold certain information or restrict access in specific circumstances.
Examples include:
- Information relating to another person
- Legal professional privilege
- Certain regulatory or legal restrictions
- Crime- and taxation-related circumstances
- Confidential information
How does DSAR Software help?
A dedicated DSAR software helps businesses centralize the operational work involved in handling access requests. From receiving access requests, corrections, erasures, and more, you can manage everything from one place with an audit trail. This reduces manual workload and compliance issues.
FAQs
Ques: What is the DSAR full form?
Ans: It stands for Data Subject Access Request.
Ques: What is a data subject access request?
Ans: A DSAR is a request that allows people to understand what data companies collect, how they use it, and who they share it with. It focuses on access. Correction and deletion are usually handled as separate data subject requests (DSRs), although many organizations process them through the same workflow
Ques: What is the difference between DSAR and DSR?
Ans: A DSAR is a request to access the personal data an organization holds about you. A DSR is the broader category that covers access, correction, deletion, restriction, and other privacy-rights requests, so every DSAR is a DSR, but not every DSR is a DSAR.
Ques: Can third-party vendors hold data covered by a DSAR?
Ans: Yes, organizations may store personal data with cloud providers, payment processors, analytics services, and other vendors. So when an organization gets a DSAR from an individual, it has to gather the relevant data to that individual from all its third-party vendors as well.
Ques: Can Parents or guardians submit a Data Subject Access Requests for a child?
Ans: Yes, Under the DPDP Act, parents or lawful guardians can exercise data rights on behalf of children, subject to the nature of the request and identity verification.
