Individuals protected by data privacy laws have the right to submit requests to follow through on their rights — in the data privacy world, this is called a data subject access request (DSAR).
Today, you’ll find DSAR forms on websites so users can easily submit one of these requests.
In this guide, I’ll describe the entire DSAR process, including what laws impact them, how users can submit them, and how businesses should respond to them in a legally compliant way.
A Data Subject Access Request (DSAR) is a way for data subjects to request access to the personal information that an organization has stored on them.
Individuals can submit requests to access, delete, correct, or transfer their data and opt out of data collection and sharing.
The original data privacy laws that required companies and websites to give users the ability to access their personal data were the:
Today, additional laws, like the Colorado Privacy Act (CPA) and the Virginia Consumer Data Protection Act (VCDPA), also require companies to give users data access rights.
DSAR requirements under all data privacy laws are broadly similar.
Most of these laws allow consumers to access, correct, or delete personal information and impose fines or penalties if businesses fail to respond to requests.
However, some details, such as response time, differ between the laws.
Discover what other U.S. states have upcoming data privacy laws entering into action that impact DSARs by checking out our interactive U.S. State Law Tracker Map.
Any individual — or a third party acting on behalf of an individual — can submit a DSAR.
For example, a legal guardian could submit a DSAR on behalf of their dependent, or a third-party company could submit requests on behalf of individuals who use their data removal services.
In addition, submissions could be from users, employees, customers, or other individuals who have had their personal data collected.
In all cases, you must verify the requestor’s identity and ensure the request is valid.
Consumers can submit a DSAR through any communication channel.
To prepare your business to receive DSARs, set up a form or email on your website for receiving these requests.
But understand that, under some laws, consumers can submit requests more informally.
For example, a consumer could email, call, post on social media, or mail a letter as a DSAR.
The request could contain detailed information or simply say, “I would like you to delete the personal information you have about me.”
Monitor all communication channels to ensure no requests get overlooked and avoid fines for legal non-compliance.
Yes, under laws like the GDPR and CCPA, a DSAR can be submitted on behalf of someone else, including all of the following:
In all of these cases, your business must follow the appropriate response steps, including verifying the data subject’s identity and responding in a timely manner.
Technically, a data subject access request is not required to be formatted in a certain way or include specific information.
An individual could submit a DSAR simply by emailing and saying, “I would like to know all the personal information you have stored on me.”
However, your business must verify the requestor’s identity and clarify the request as necessary so you can learn more about what law they’re submitting under and the nature of their request.
If you have a specific DSAR form on your site or the requestor uses a template, it may include information about the law that applies to the request and whether it is for access, deletion, transfer, or editing.
You can access DSAR software by signing up for Termly, which helps you gather and track necessary information to handle consumer requests properly.
With a Termly account, you can link a DSAR form like the one pictured below on your site.
The timeline for responding to DSARs varies based on the applicable law:
Yes, depending on the law, you may refuse to respond to a DSAR under certain circumstances and in specific situations.
GDPR
Under the GDPR, you can refuse to respond to a DSAR if you believe the request is malicious in nature or for legal reasons.
For example, sometimes legal proceedings require the use of personal data, in which case, it prevents the DSAR from being completed.
However, you cannot claim a normal request is malicious simply to avoid responding to it and must take steps to confirm the validity of the DSAR.
To deny a request under the GDPR, you must:
CCPA
The CCPA also allows for specific circumstances where you can refuse to respond to a request.
You can refuse a DSAR if the personal information is needed to fulfill a contractual obligation between your business and the requestor or if you’re legally obligated to retain the data.
If you are refusing a DSAR under the CCPA, you must:
Other Data Privacy Laws
Additional data privacy laws, like the VCDPA and CPA, also allow you to deny DSARs for the same reasons as the GDPR and the CCPA.
You must inform the individual of your decision, give your reasons for the denial, and explain your appeal process.
If you do not respond to a DSAR, you could be subject to fines, legal action, or other penalties depending on which data privacy regulation applies to you.
GDPR
Under the GDPR, data subjects can file complaints to supervisory authorities if their requests are ignored or inadequately addressed.
These complaints can lead to an investigation, which could result in significant GDPR fines:
CCPA
Not responding to a DSAR can also be considered a violation of the CCPA, which can cost businesses:
Other Data Privacy Laws
Other laws also penalize businesses that don’t adequately respond to DSARs from consumers, which include the following:
Beyond the potential for fines or legal action, you should also consider the reputational risks of not responding to consumer requests.
Consumers today are increasingly aware of data privacy and feel concerned about how their personal data gets used.
As a result, consumers may avoid using a website or business’s services if they don’t comply with data privacy laws.
Your exact process for responding to requests may vary based on your company or website’s specific circumstances, but remember to document your DSAR response process to ensure you handle requests accurately and fairly.
For many organizations, the process below is a good starting point for how to respond to a data subject access requests:
A DSAR form or request template can help you manage some of these steps. For example, Termly’s DSAR form includes necessary information, such as:
Remember, even though most data privacy laws require you to provide a means for consumers to follow through on their privacy rights, users can submit DSARs through any channel, such as social media, phone, or email.
However, it helps to have a dedicated way for your consumer to submit their requests, so get started with Termly’s DSAR form by signing up for free.
Check out some of the most frequently asked questions we get about DSARs below.
Under most data privacy laws, you can’t charge a fee for a DSAR unless the request is excessive or unfounded.
You must prove that the request is excessive and the fee itself must be reasonable.
Yes, you can redact information from a DSAR response if it doesn’t apply to the request or if it risks revealing another individual’s or third party’s information.
Never share any personal information about a different individual with the requestor.
If you have a data protection officer (DPO), they’ll likely respond to any DSARs. If you do not have a DPO, whoever manages your organization’s data protection and privacy is the best person to respond to DSARs.
The person responsible for responding to DSARs may need assistance from various members of your organization to complete the requests.
You may run into several issues with DSARs, including:
Yes, current and former employees can submit DSARs to their employers. If there is a legitimate reason that you cannot fulfill the request, it’s possible to refuse.
For example, you may need an employee’s personal information to pay them, making it impossible to delete all their personal information entirely.
Depending on the data privacy laws that affect your business, some users have the right to submit requests regarding how their personal information gets collected, processed, and used.
Establishing a process for responding to DSARs is essential, as it helps with everything from legal compliance to ensuring you can find all data about the requester to minimizing your DSAR response time.
Make it easy on your business by accessing Termly’s suite of compliance solutions, and get a comprehensive DSAR form you can easily embed on your website.
Masha is an Information Security and Data Privacy Specialist and a Certified Data Protection Officer. She has been a Data Protection Officer for the past six years, helping small and medium-sized enterprises achieve legal compliance. She has also been a privacy compliance mentor to many international business accelerators. She specializes in implementing, monitoring, and auditing business compliance with privacy regulations (HIPAA, PIPEDA, ePrivacy Directive, GDPR, CCPA, POPIA, LGPD). Masha studied Law at Belgrade University, and she passed the Bar examination in 2016. More about the author
