{"head":{"title":"What Is a Data Subject Request (DSR) Under GDPR? | OceanLab","description":"A data subject request is a person asking to use a GDPR right over their data, such as access or erasure. The rights, the one-month deadline and mistakes.","canonical":"https://oceanlab.in/glossary/data-subject-request"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"data subject request","path":"/glossary/data-subject-request"}],"slug":"data-subject-request","term":"Data subject request (DSR)","aka":["DSR","DSAR","subject access request"],"category":"Compliance","short":"A request from a person to use one of their GDPR rights over their personal data, such as access, correction, deletion or a copy to take elsewhere.","body":[["The GDPR gives people rights including access (Article 15), correction (16), erasure (17), restriction (18), data portability (20) and objection (21). A request to use any of them is often called a data subject request; an access request specifically is a DSAR."],["Article 12(3) says the ",{"href":"/glossary/data-controller","text":"controller"}," must respond without undue delay and within one month of receiving the request. That can be extended by two further months for complex or numerous requests, but the person must be told within the first month."]],"why":["A month is short if finding someone's data means searching six systems by hand. Products that hold personal data need ways to find, export, correct and delete one person's data across the database, files, backups and third-party tools."],"example":["A user of a learning platform asks for all data held about them. Support runs an admin export that gathers the profile, course history, messages and payment records into one file, and logs the request. It takes ten minutes instead of a week."],"inBuild":["Export and delete-one-user features are cheap to design into an admin dashboard during the build and expensive to add once data is spread across services."],"mistakes":[["Forgetting data in logs, analytics, support tools and backups."],["Deleting a user without handling records the law requires you to keep, such as invoices."],["No identity check before handing data over, which can itself cause a breach."]],"related":[{"href":"/glossary/data-controller","label":"Data controller (GDPR)","detail":"Under the GDPR, the organisation that decides why and how personal data is processed, alone or jointly with others."},{"href":"/glossary/lawful-basis","label":"Lawful basis (GDPR)","detail":"One of the six reasons listed in GDPR Article 6 that make processing personal data lawful, such as consent or a contract."},{"href":"/glossary/data-processor","label":"Data processor (GDPR)","detail":"Under the GDPR, an organisation that processes personal data on behalf of a controller and only on its documented instructions."},{"href":"/glossary/dpa","label":"DPA (data processing agreement)","detail":"The contract the GDPR requires between a data controller and a processor that handles personal data for it."}],"tools":[],"links":[{"href":"/compliance/gdpr","label":"GDPR guide","detail":"Who the GDPR applies to and what it asks of software."}],"sources":[{"title":"Regulation (EU) 2016/679, the GDPR (Official Journal)","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}