A data subject access request (DSAR) under GDPR Article 15 is a request from a person to see the personal data you hold about them. Article 15 of the General Data Protection Regulation gives individuals the legal right to ask what personal data you hold about them and receive a copy of it. You must answer within one month, free of charge in almost every case, and you can extend by two further months only for complex or numerous requests.
Anyone whose data you process can submit a DSAR at any time. Managing these requests requires a strict internal process and a solid grasp of your regulatory obligations.
Failing to answer a DSAR correctly exposes your business to financial and legal risk. Supervisory authorities treat the right of access as a foundational element of privacy law. A delayed or incomplete response routinely triggers regulatory investigations, enforcement notices and administrative fines. Deliberately concealing information to avoid disclosure can even result in criminal prosecution in certain jurisdictions.
You need a clear process to identify, handle and answer these requests within the statutory deadlines.
What Article 15 requires you to disclose
The right of access covers much more than a raw data export. Article 15(1) of the GDPR dictates that you must confirm whether you process the person's data and provide a broad set of supplementary information.
You are legally required to disclose the following details when responding:
- The specific purposes of your processing activities.
- The categories of personal data you hold.
- The recipients or categories of recipient to whom the data has been or will be disclosed, particularly those in third countries.
- The envisaged retention period, or the criteria used to determine that period.
- Information regarding the source of the data if you did not collect it directly from the individual.
- The existence of automated decision-making, including profiling, and meaningful information about the logic involved.
You must provide a copy of the personal data undergoing processing, usually in a commonly used electronic format like a CSV or PDF file. You cannot charge for this first copy, though Article 15(3) permits a reasonable fee based on administrative costs for any further copies requested by the same person.
A frequent mistake is assuming you must hand over every internal document mentioning the person's name. The Court of Justice of the European Union clarified in May 2023 (Case C-487/21) that the term copy relates to the personal data itself, not the original documents. You only need to provide full copies of documents or emails if the context is essential for the data subject to exercise their rights effectively.
Providing the correct information while withholding confidential company data or the personal data of other employees requires careful redaction.
Recognising a valid data subject access request
A data subject does not need to use formal legal terminology to trigger your obligations. They do not have to mention "Article 15", "GDPR", or even "DSAR" in their communication.
If an individual asks "What information do you hold on me?" or "Send me everything you have on my account," the legal clock starts ticking immediately. The request can arrive via email, a contact form, social media, or even verbally during a phone call with your support team.
The statutory deadline for responding is one calendar month from the day you receive the request. You can extend this by a further two months if the request is particularly complex or if the individual has submitted multiple overlapping requests. You must notify the data subject of this extension and the reasons for it within the initial one-month window.
Verifying the identity of the requester is your first operational hurdle. The European Data Protection Board (EDPB) states in its Guidelines 01/2022 on the right of access that you should not ask for more personal data than necessary to confirm an identity. Demanding a copy of a passport or national ID card is generally considered disproportionate if you can verify the person through an existing customer account portal or by sending a secure confirmation link to their registered email address.
The one-month DSAR clock
DSAR compliance in six steps
A repeatable DSAR process is what keeps you inside the one-month deadline, and it is easier to run when one person owns it and knows where personal data lives. These six steps cover a typical request:
- Receive and log the request the day it arrives, whatever the channel, with the date the clock starts.
- Verify the requester's identity with the least data that does the job, such as a confirmation link to the registered email address.
- Search every system that holds the person's data: your databases, email, support tools, marketing platforms and the services your processors run for you.
- Redact other people's personal data and anything covered by an exemption, and record why.
- Respond with the data and the Article 15(1) information in a commonly used electronic format, within one month or with an extension notice.
- Record what you sent, when and what you withheld, so you can show the regulator how you handled it.
Requests through third-party portals and proxies
Data subjects frequently use automated services or solicitors to submit requests on their behalf.
When you receive a DSAR from a third-party portal, you must establish that the service has the legal authority to act for the individual. The Information Commissioner's Office warns against releasing data blindly. You must verify the person's identity and check that they genuinely agreed to have their data uploaded to the specific portal.
Providing data to an unauthorised third party is itself a personal data breach. If you have reasonable grounds to doubt the authorisation, you should pause the request and ask the portal for concrete evidence of their mandate. You can also contact the individual directly to confirm they initiated the process, and sending the data directly to the individual's known email address often provides a safer alternative.
Take particular care with requests submitted on behalf of children.
Hostile access requests are rising
Many individuals submit access requests to understand how a business uses their data. Others use them as a tool in a dispute: former employees often file a DSAR alongside a tribunal claim or during settlement negotiations, to obtain documents before formal disclosure.
Responding to a hostile employee request involves searching through years of emails, HR files, and internal communications.
The EDPB has taken a strict stance on the effort required to locate this data. According to the final version of its guidelines, published in April 2023, the EU GDPR contains no general exemption for proportionality. If a data subject asks for all their data, you must search through all IT and non-IT filing systems, regardless of the administrative burden, unless you can prove the request is "manifestly unfounded or excessive". Proving a request is excessive requires a very high threshold of evidence.
How the UK DUAA limits search obligations
The rules in the United Kingdom have diverged from the European Union approach.
In June 2025, the UK passed the Data (Use and Access) Act (DUAA), which amended the UK GDPR to give businesses some operational relief. Section 78 of the Act inserted a new Article 15(1A), which states that a data subject is only entitled to the information the controller can provide "based on a reasonable and proportionate search". It came into force on Royal Assent, 19 June 2025, and is treated as having applied since 1 January 2024, so it codified the approach UK courts already took.
The DUAA also formally introduced a "stop the clock" rule, which has applied since 5 February 2026 (section 76, new Article 12A of the UK GDPR). If you reasonably need more information to identify what the request covers, you can ask for it, and the one-month deadline pauses until the requester replies. You must still ask promptly rather than waiting until the end of the month.
These changes mean your process must adapt depending on whether you are responding under the EU GDPR or the UK GDPR.
EU and UK approaches compared
The differences between the jurisdictions dictate how you allocate internal resources.
| Regulatory feature | EU GDPR (Article 15) | UK GDPR (after the DUAA) |
|---|---|---|
| Search scope | No general proportionality limit. You must search all systems. | Limited explicitly to a "reasonable and proportionate" search (since 19 June 2025). |
| Clarification delays | The response clock continues running unless ID verification is pending. | The deadline pauses while you wait for clarification (since 5 February 2026). |
| Identity verification | Strict limits on requesting additional physical ID documents. | Similar strict limits, with a pragmatic approach to third-party portals. |
| Fee charging | Only permitted if the request is "manifestly unfounded or excessive", or for further copies. | Only permitted if the request is "manifestly unfounded or excessive", or for further copies. |
If your website serves users in both regions, you must carefully categorise incoming requests to apply the correct legal standard. Adopting a unified approach based solely on the strictest interpretation often creates unnecessary operational bottlenecks.
Exemptions to the right of access
You do not always have to disclose every piece of personal data you hold.
Both the EU and UK GDPR contain specific exemptions designed to protect competing interests. Article 15(4) explicitly states that the right to obtain a copy must not adversely affect the rights and freedoms of others. If releasing a document exposes the personal data of a colleague or breaches corporate intellectual property, you must redact that specific information before disclosure.
Applying an exemption requires a documented, case-by-case analysis. You cannot apply blanket refusals across an entire DSAR because some documents contain sensitive commercial information. In the UK, exemptions such as legal professional privilege and management forecasts come from Schedule 2 of the Data Protection Act 2018. If you decide to withhold data, you must explain your reasoning to the data subject and inform them of their right to complain to the supervisory authority.
Recent enforcement actions and penalties
Data protection authorities actively act against organisations that mishandle access requests.
In 2025, the UK Information Commissioner's Office (ICO) issued enforcement notices to two public bodies over subject access backlogs. On 24 September 2025, it ordered Bristol City Council to contact everyone with an overdue request, resolve the oldest cases from 2022 within 30 days and report weekly. On 9 October 2025, it ordered South Wales Police, which had answered only 29% of requests on time between April 2023 and March 2024 and had 352 overdue requests in August 2025, to clear the backlog by June 2026.
Civil enforcement is not the only risk. Under section 173 of the Data Protection Act 2018, it is a criminal offence to alter, deface, block, erase, destroy or conceal information with the intention of preventing its disclosure in response to an access request. The offence applies to the organisation and to any person employed by it, so deliberate obstruction can lead to personal criminal liability.
Train your staff never to delete emails or records because a difficult access request has arrived.
Preparing your systems for access requests
Handling access requests manually is no longer viable for most digital businesses.
You must establish a dedicated, documented procedure for logging and fulfilling DSARs before a complex request lands in your inbox. This process should map exactly where personal data resides across your databases, marketing platforms, and third-party software applications. If a user asks for their data, your engineering or support team needs a straightforward way to extract it without manually querying dozens of separate systems.
Reviewing your data retention policies heavily reduces your DSAR workload. If you systematically delete old, unnecessary personal data, it cannot fall within the scope of a future access request. You cannot disclose what you no longer possess.
Clear communication with the data subject often prevents a standard request from escalating into a formal regulatory complaint.
Consent records belong in a DSAR response
Consent records generated by your cookie banner are personal data.
When an individual submits a DSAR, they have the right to know what tracking technologies you deployed on their device and when they consented to them. If you set analytics or marketing cookies without logging a proper consent trail, you will struggle to provide an accurate response under Article 15, and the requester will see that their data was processed without a recorded choice.
Kukie.io's Consent Log keeps a record of each visitor's choice, with the time, the categories accepted or rejected and a consent ID that finds every record of the same browser, and you can export these consent receipts to answer that part of a DSAR. Timestamped records show both the person and the regulator what was agreed and when.
Quick answers on DSARs
How many days do you have to respond to a DSAR?
You must respond to a Data Subject Access Request without undue delay and at the latest within one calendar month of receipt. This period can be extended by a further two months for complex or numerous requests, provided you inform the individual within the first month. In the UK, the clock also pauses while you wait for clarification you reasonably need.
Can I charge a fee for a Subject Access Request?
In almost all cases, you must provide the information free of charge. You can only charge a reasonable administrative fee if the request is manifestly unfounded, excessive, or if the individual asks for further copies of data you have already provided.
Do I have to provide physical copies of documents in a DSAR?
No, you are only required to provide a copy of the personal data itself, not the original documents containing the data. If the request is made electronically, you should provide the data in a commonly used electronic format like a secure PDF or CSV file.
What is the difference between Article 15 and Article 17?
Article 15 of the GDPR grants the right of access, allowing individuals to see what data you hold about them. Article 17 grants the right to erasure (the right to be forgotten), allowing individuals to request that you delete their personal data.
Can an employee submit a DSAR during a tribunal claim?
Yes, employees can submit an access request even if they are involved in active litigation or tribunal proceedings against you. You cannot refuse a valid request because the data might be used in a legal dispute.
What happens if I ignore a Data Subject Access Request?
Ignoring a DSAR is a breach of the GDPR. The individual can complain to your national supervisory authority, which can issue a formal reprimand or an enforcement notice, order you to respond, or impose administrative fines.
Keep a record of every cookie choice
If a visitor asks what they agreed to, the answer should take minutes, not days. Kukie.io blocks non-essential cookies until visitors choose, records each choice in the Consent Log and lets you export the records when a request arrives. See the full list of Kukie.io features.
