Data Subject Access Request (DSAR)

What is a data subject access request?

A data subject access request (DSAR) is a request from a person asking what personal data you hold about them. Under GDPR Article 15, they can get a copy of the data and details such as why you use it, who receives it, and how long you keep it. The term is also used loosely for related requests, such as asking you to delete or correct data.

Deadlines are short. Under the GDPR you must answer within one month, which can be extended by two further months for complex or numerous requests if you tell the person within the first month (Article 12(3)). Under California's CCPA, a business must confirm receipt within 10 business days and respond within 45 calendar days, with one 45-day extension if it tells the consumer (CPPA FAQ).

Why it matters to you

Much of the data you hold sits with your vendors: your CRM, support desk, email tool and analytics. To answer a request fully, you often need data from them too. The steps usually look like this:

1. The person sends a request to you, or to one of your vendors.
2. If it reaches a vendor, the vendor's DPA says whether it forwards the request to you.
3. You find the person's data in your own systems and in each vendor that holds it.
4. Vendors help you pull, correct or delete the data, as their DPA promises.
5. For corrections or deletions, you tell each recipient of the data, unless that is impossible or takes disproportionate effort (Article 19).
6. You answer the person within the deadline.

The deadline is yours, not the vendor's. EDPB guidance says the controller stays responsible for complying with requests even if a processor handles the practical work (EDPB Guidelines 07/2020, paragraph 132). California's rules similarly require service providers to help a business answer requests to know (CCPA Regulations, section 7024(i)).

Vendor promises can change. Venpo flagged that Klaviyo no longer promises to pass privacy requests on to you. Since September 2026, Klaviyo may instead tell the person to contact you directly. Make sure your privacy notice gives people a clear way to reach you.

What to check

• In each vendor's DPA, find the clause on data subject requests. HubSpot's DPA, for example, says it will "advise the Data Subject to submit their request to you" (HubSpot DPA, section 4).
• Check whether the vendor offers self-service tools to find, export or delete one person's data. See data export.
• Check whether help is free or costs extra. HubSpot's DPA lets it charge reasonable costs, disclosed in advance.
• Keep your vendor inventory current, so you know every place a person's data might sit.

How Venpo helps

Venpo watches your vendors' DPAs and privacy policies and emails you when a promise about forwarding or handling privacy requests changes. You get what changed and why it matters, and a change history for each vendor.