What is the right to access personal data?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Under GDPR Article 15, any person whose data you hold can ask for a copy of it and information about how you're using it. This is called a Subject Access Request (SAR), and it's a right you're legally required to support.
What they can ask for: confirmation you hold data on them, a copy of that data, why you're processing it, how long you'll keep it, who you've shared it with, and whether it came from a third party. That's a broad scope, and you need to be ready for it.
You have one month to respond from the day you receive the request. Extensions of up to two additional months are allowed for complex requests, but you must notify the person within the first month that you're extending and explain why.
In email marketing terms, a SAR typically means exporting everything you hold on a specific subscriber: their profile, campaign history, click and open records, consent records, and anything else in your ESP, CRM, or analytics tools. Most reputable ESPs now have SAR export features. If yours doesn't, you'll need to compile it manually across every system where subscriber data lives.
That includes any sub-processors too. If you sent that data to a retargeting platform or analytics tool, their copy of the data is also within scope.
Build the SAR process before you need it. A 30-day clock goes fast when you're scrambling to figure out which systems hold what data. Check the deadline details in our guide to DSAR response timelines.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
