What is a DSAR and what to do when one arrives

A DSAR is a data subject access request: someone asking you for a copy of the personal data you hold about them, plus a few facts about how you use it. In the UK the ICO calls it a subject access request, or SAR. Same right, shorter name.

They arrive in odd places. A line at the end of a complaint. A direct message on Instagram. A phone call to whoever picks up. This post covers who can send one, how the one-month clock runs, what to include, what you can leave out, and how a small company puts a route for it on its website so the next one doesn’t get lost.

What a DSAR gives the person

Article 15 of the UK GDPR sets out three things. Confirmation that you’re processing their data. A copy of it. And a list of facts alongside the copy: the purposes, the categories, the recipients, how long you keep it, their rights to correct, erase and object, where the data came from if not from them, and any automated decision-making. Since 19 June 2026 the UK list also includes their right to complain to you directly, under a new section 164A.

The EU text is the same list without that last item. It’s Article 15 of the GDPR, and the EDPB’s guidelines on it say the person does not have to give reasons for asking, and it isn’t for you to judge whether the request will help them.

The ICO puts it in one line: the right of access gives people the right to obtain a copy of their personal information from you. The first copy is free. For further copies you can charge a reasonable fee based on your costs.

Who can send one, and how

Anyone whose data you hold. The ICO’s guidance on recognising a request is plain: There are no formal requirements for a valid request. A person can ask verbally or in writing, including by social media, to any part of your organisation, and they don’t have to say “subject access request”. It only needs to be clear that they’re asking for their personal information.

You can offer a form or an online system. You can’t make it the only way in. The ICO says to make clear that using it isn’t compulsory. The EDPB says the same for the EU: you should offer appropriate and user-friendly communication channels, but a person who uses another contact point you published has still made a valid request. A request sent to a random address you never gave out is a different matter.

Someone can ask on another person’s behalf with written authority, and the ICO’s small-organisation guide says children over 12 can usually make their own requests.

The one-month clock

In the UK the clock is now written into the law itself. Article 12A, in force since 5 February 2026, says the period is one month beginning with the relevant time, and the relevant time is the latest of three dates: when the request arrives, when any identity information you asked for arrives, and when any fee is paid. You can extend by two further months for complexity or for the number of requests, by giving notice with reasons before the first month ends. If you reasonably need more detail to find what they’re asking about, the days you spend waiting for the answer don’t count.

The EU rule is Article 12(3): without undue delay and in any event within one month, with the same two-month extension. The EDPB calls it good practice to confirm receipt in writing and say that the period runs from day X to day Y.

Two practical notes from the ICO’s small-organisation guide. It’s a calendar month, so a deadline that lands on a weekend or public holiday moves to the next working day, and a reminder set for 28 days avoids trouble with short months. And on identity: don’t ask for formal ID unless it’s necessary and proportionate. If a regular customer writes from the email on their account, a security question is enough.

What to include

A copy of their personal data, not every document that mentions them. The ICO’s search guidance draws the line: in an email, the right of access only applies to the personal information in the email that relates to the person. You can copy the relevant parts into a new document rather than hand over whole threads.

The search has a standard. Article 15(1A), added in 2026, says the person is entitled only to what you can find with a reasonable and proportionate search. The ICO’s reading of that:

• Email: a message sitting in “Deleted items” counts as held, because it’s still easy to reach.
• Backups and archives: there’s no technology exemption. The ICO expects the same effort you’d make to find the information for your own purposes.
• Deleted data: you’re not expected to reconstitute what you removed under your normal records policy.
• Narrowing: you may ask the person what they’re after, and the clock pauses while you wait.

How much the 2026 wording narrows a search in practice is still open. The ICO’s search page doesn’t mention the new paragraph yet, and I haven’t seen a published decision that turns on it.

The supplementary facts can be a link to your privacy policy if it already covers them. If the request came by email, the ICO says to reply by email unless they ask otherwise, in a commonly used electronic format that doesn’t need them to buy software. Send it securely, and keep a dated record of what went out.

What can be left out

Other people’s data, most often. Article 15(4) says the copy shall not adversely affect the rights and freedoms of others. The ICO turns that into three steps: can you answer without revealing anyone else, has the other person consented, and if not, is it reasonable to disclose anyway? If the answer at the end is no, you withhold that part, give as much of the rest as you can, and write down why.

A handful of exemptions cover specific material: confidential references, legal advice, management forecasts, and notes about a negotiation with the person asking while it’s still live. The ICO’s list says you cannot routinely rely on exemptions or apply them in a blanket fashion. Each one covers only the information it names, case by case, with a note of your reasons.

Then there’s refusal. You can refuse a request, or answer it and charge a fee, if it’s manifestly unfounded or excessive. The ICO calls this a high threshold. Its examples: a person who offers to drop the request in exchange for account credit, or a repeat of a recent request where nothing has changed. A large request isn’t excessive because it’s large, and angry wording doesn’t make it unfounded. If you refuse, the reply still goes out within the month, with your reasons and a note of their right to complain.

What happens when a request is ignored

Two UK outcomes show the range. In September 2022 the ICO reprimanded Virgin Media after it received over 9,500 requests in six months of 2021 and answered 14% of them late. The ICO noted that the company’s performance had improved by 2022. No fine.

The other case was criminal. In April 2023 a woman acting under a lasting power of attorney asked a care home for her father’s records. The director didn’t reply, and the ICO found he had blocked, erased or concealed records to stop them being disclosed. In September 2025 a magistrates’ court fined him £1,100 with £5,440 in costs. The ICO’s head of investigations put it plainly: We describe subject access requests as a fundamental right.

Set up a route on your website

The ICO’s preparation guidance says you should appoint a specific person or central team to handle requests, train staff to recognise one, keep a log, and that you could publish how to ask, on your website or in your privacy notice. None of that needs software. Check your own site from your phone:

1. Open your privacy policy and search the page for “access” or “your rights”. Is there a sentence that says how to ask, with an address or a form?
2. Tap the route it names. Does the email app open with the right address? Does the form load and send?
3. Go to your home page. Is the privacy policy one tap away in the footer?
4. Look at who reads that inbox. If it’s one person, add a second, and make sure both know what a request looks like.
5. Write a two-line autoreply for that address: we received your message on this date, and we’ll reply by that date. The acknowledgment is the EDPB’s good practice and it starts your own clock.
6. UK sites: put the complaints route beside it. Since 19 June 2026, people can complain to you directly, and the ICO’s complaints guidance says you need a process for handling data protection complaints, with an acknowledgment within 30 days and, in its words, there are no exemptions to this.
7. Set a 28-day reminder in whatever calendar you already use, and a note of where the data lives: the shop platform, the mailing list, the booking tool, the inbox.

If a request asks for deletion rather than a copy, the clock and the route are the same. Right to be forgotten covers that side. For the wider list of what an EU site is expected to show, the GDPR compliance checklist is the place to start, and what is personal data helps with the search itself.

Peeky reads the public pages of your site. For the route a person uses to ask, the checks are UK-09 and EU-07 in the Handbook, and UK-08 for the complaints route that sits beside it.

Questions people ask

What can I ask for in a DSAR?

Confirmation that you hold their data, a copy of it, and a set of facts about how you use it: the purposes, the categories, who receives it, how long you keep it, their rights, where it came from and any automated decisions. That list is Article 15 of the UK GDPR and the matching article of the EU GDPR.

What should I do if I receive a DSAR?

Log the date, confirm receipt, check who's asking, and work out the deadline: one month from the latest of the request, any identity information you asked for and any fee. The ICO's step-by-step guide for small organisations walks through the search, the redactions and the reply.

What can be excluded from a DSAR?

Other people's personal data, where you can't disclose it with their consent or reasonably without it. The ICO sets out a three-step test for that. A few exemptions also apply to specific material, like confidential references and legal advice, but none of them works as a blanket.

On what grounds can a SAR be refused?

When it's manifestly unfounded or excessive, and the ICO calls that a high threshold. A big request isn't excessive because it's big. A repeat of a recent request with nothing changed might be. You still reply within the month and say why.

Do I need a DSAR template?

Not for the person asking. The ICO says there are no formal requirements for a valid request, so a form can be offered but not required. On your side, a short acknowledgment template and a checklist for the reply save time.