Glossary
Subject access request
Also called: SAR, DSAR, data subject access request
A subject access request is an individual's request for a copy of the personal data an organisation holds about them, together with information about how it is used. Under the UK and EU GDPR the response is due within one month, extendable in limited circumstances.
Subject access request explained
What must be provided
A copy of the personal data, plus the purposes of processing, the categories of data, the recipients, the retention period, the source where not collected from the individual, and the rights available to them. The data itself is usually the smaller part of the work.
Why retrieval is the constraint
Personal data about one person is rarely in one system. It is in the HR or CRM record, in email, in scanned correspondence, in meeting notes, and in documents filed by individual departments. A request that requires canvassing several teams to ask where they keep things will miss a one-month deadline.
This is the strongest operational argument for a controlled repository: search across document contents and metadata turns a canvass into a query, and a saved query can be re-run and evidenced.
Exemptions and third-party data
Not everything is disclosable. Legal privilege, information about other identifiable people, references given in confidence in some jurisdictions, and material subject to specific statutory exemptions can be withheld or redacted. Each redaction should carry the ground relied on, because an internal review or a regulator will ask.
What to retain afterwards
The request, the response, the search performed and the exemption decisions. These are records in their own right with their own retention period, and they are what you produce if the response is challenged.
FAQ
Subject access request: common questions
Can we charge for a subject access request?
Generally no under the GDPR, though a reasonable fee may be charged for manifestly unfounded or excessive requests, or for further copies. The bar for treating a request as excessive is higher than most organisations assume.
Does a request cover backups?
In principle personal data in backups is in scope, though regulators have generally accepted proportionality arguments about restoring archived backups. Take advice rather than assuming either way.
Related terms
- 21 CFR Part 1121 CFR Part 11 is the FDA regulation governing electronic records and electronic signatures in regulated life sciences.
- Business associate agreementA business associate agreement is the contract HIPAA requires between a covered entity and any vendor that creates, receives, maintains or transmits protected health information on its behalf.
- Data processing addendumA data processing addendum is the contract between a controller and a processor governing how personal data is handled.
- eIDASeIDAS is the EU regulation establishing a framework for electronic identification and trust services.
- ESIGN ActThe ESIGN Act is the US federal statute giving electronic signatures and records the same legal effect as paper, provided the parties intended to sign and consented to transact electronically.
- GDPRThe General Data Protection Regulation governs the processing of personal data in the EU, with an equivalent UK regime.
Zuletzt geprüft: 28. August 2026. Browse the full glossary.