What GDPR and a DSAR actually require
DSAR Lite is for the person who owns privacy alongside everything else. The product stays narrow on purpose. The obligations underneath it are not.
GDPR
The General Data Protection Regulation is the European Union law on personal data. It has applied since 2018. It gives people control over data an organization processes about them, and it gives the organization a matching set of duties: a lawful reason to process the data, a limit on how long it is kept, and a way for the person to find out what is happening with it.
GDPR sets out eight rights for the person the data is about. The one teams meet most often is the right of access. The others include rectification, erasure, restriction, portability, and objection. A growing company does not get a smaller version of these duties because the privacy team is one person.
DSAR
A data subject access request, or DSAR, is the request a person sends to use the right of access. They ask the organization to confirm whether it is processing their personal data, and to hand over a copy together with an explanation of that processing. People can ask at reasonable intervals so they can check the processing is lawful.
The request does not have to be labeled a DSAR, and it does not have to mention GDPR or name a specific right. Someone can email, call, or message any part of the company — including a channel that was never meant for privacy — and simply ask what data you hold. The organization still has to recognize it and answer in time. That is why the people who read the inbox need a queue, not a hope that the request finds the right person.
What the reply has to include
When you respond, you confirm whether you are processing their data, provide a copy, and explain the processing. That explanation covers:
- Why you process the data
- The categories of personal data
- Who you share it with, if anyone
- Where it came from, if you did not collect it from the person
- How long you keep it, or how you decide that period
- Whether you use automated decision-making, including profiling
- Their other rights, including rectification, erasure, and restriction
Who can send one
Anyone whose personal data you process can ask: customers, employees, partners, and contractors. They do not have to give a reason. Research on these requests tends to show more of them come from customers than from employees, though employees of EU companies ask more often than employees elsewhere.
Someone else can ask on a person's behalf when that person authorizes them. A parent can ask for a child, a lawyer for a client, a guardian for the person they represent. You can, and should, ask for written authorization. You can also check that the requester is who they say they are. Use a reasonable check — an existing login, or email — and do not demand more identity documents than the request actually needs.
The deadline, and the fee
Answer without undue delay, and within one month of receiving the request. If the request is complex, or the same person has sent several at once, you may extend by up to two further months. Tell them about the extension within the first month, and say why. The month runs from the day you receive the request, or from the day you receive the identity details you reasonably asked for.
The reply is free. A reasonable fee is only for a request that is manifestly unfounded or excessive, and it covers administrative cost, not a profit. Refusing a request is possible in those same narrow cases, and when a legal exemption applies. If you refuse, you tell the person why, and you tell them they can complain to a supervisory authority or go to court.
Where DSAR Lite fits
The product is a case tracker with the deadline already computed: one month under GDPR, 45 days under CCPA. Letter templates cover acknowledgment, fulfillment, denial, and extension. Data inventory, consent records, and a breach log sit beside the queue so the reply is assembled from records you already keep, not from a search through inboxes the week the deadline arrives.
