Data subject request (DSR)
Also called DSR, DSAR, subject access request.
A request from a person to use one of their GDPR rights over their personal data, such as access, correction, deletion or a copy to take elsewhere.
Last updated
What it is.
The GDPR gives people rights including access (Article 15), correction (16), erasure (17), restriction (18), data portability (20) and objection (21). A request to use any of them is often called a data subject request; an access request specifically is a DSAR.
Article 12(3) says the controller must respond without undue delay and within one month of receiving the request. That can be extended by two further months for complex or numerous requests, but the person must be told within the first month.
Why it matters
A month is short if finding someone's data means searching six systems by hand. Products that hold personal data need ways to find, export, correct and delete one person's data across the database, files, backups and third-party tools.
In a product build
Export and delete-one-user features are cheap to design into an admin dashboard during the build and expensive to add once data is spread across services.
Common mistakes.
- 01
Forgetting data in logs, analytics, support tools and backups.
- 02
Deleting a user without handling records the law requires you to keep, such as invoices.
- 03
No identity check before handing data over, which can itself cause a breach.
Read the official text.
Primary sources this definition is based on.
- Regulation (EU) 2016/679, the GDPR (Official Journal)checked 2026-10-25
Related terms.
- Data controller (GDPR)Under the GDPR, the organisation that decides why and how personal data is processed, alone or jointly with others.
- Lawful basis (GDPR)One of the six reasons listed in GDPR Article 6 that make processing personal data lawful, such as consent or a contract.
- Data processor (GDPR)Under the GDPR, an organisation that processes personal data on behalf of a controller and only on its documented instructions.
- DPA (data processing agreement)The contract the GDPR requires between a data controller and a processor that handles personal data for it.
