What is a Subject Access Request (SAR) or Data Subject Access Request (DSAR)?

A Subject Access Request (SAR) or Data Subject Access Request (DSAR) is a formal request from someone asking you to show them the personal data you hold about them. Under GDPR Article 15, this is a legal right. If you operate in the EU or UK, you have to respond to these. and you have a deadline.

For email marketers, a SAR might look like: a subscriber emails you asking "what data do you have about me?" Or you receive a formal written request through your privacy inbox. Either way, it's a SAR, and the clock starts when you receive it.

What the law requires you to provide:

• Confirmation that you process their personal data (or don't)
• A copy of that data. email address, name, preferences, engagement history, consent records, any profile data you hold
• Why you're processing it (lawful basis)
• Who you've shared it with (third-party processors, advertising platforms)
• How long you'll keep it
• Information about their other rights (rectification, erasure, objection)

The timeline: Under GDPR, you have one calendar month to respond from the date of receipt. You can extend by up to two additional months for complex requests, but you must notify the person within the first month that you're extending. Missing the deadline is itself a violation.

SARs are free to fulfill. you can't charge the person for a standard request. You can request additional information to verify identity, but you can't use that as a delay tactic.

The practical implication for email programs: you need to be able to locate all data you hold on a person across all your systems (ESP, CRM, advertising platforms, enrichment services) and compile it within the deadline. If that's not something you've thought through before, a SAR arriving is a stressful time to figure it out. For handling the identity verification step, see verifying identity for data requests. For record-keeping obligations, see DSAR record-keeping.