How quickly must DSARs be answered?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Under GDPR, you have one month from receiving a Data Subject Access Request (DSAR) to respond. That clock starts the day you receive the request, not the day you verify their identity or the day you start compiling the data.
If the request is complex or you've received multiple requests from the same person at once, you can extend by up to two more months. But you need to tell them within the first month that you're taking more time and why. Missing that notification is treated as a breach of the one-month deadline.
You can ask the person to verify their identity before responding, and that's sensible. But the clock is still running while you do it. Build identity verification into your first response, not as a reason to delay starting the work.
Under UK GDPR the rules are the same. CCPA in California gives businesses 45 days with a possible 45-day extension. CASL doesn't have a formal DSAR framework in the same way, though prompt responses are still best practice.
In practice, the biggest delay most senders face is data compilation: pulling records from ESP, CRM, analytics tools, and any other system where subscriber data lives. Build that process before you need it. A 30-day window disappears fast when you're figuring out which systems hold what. See our guide on subject access requests for what to include, and check that your DPA with your ESP covers how they support DSAR compliance.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
