The DSAR process is the sequence of steps an organisation follows to receive, scope, review, redact and disclose personal data in response to a data subject access request. This hub brings the ProvePrivacy guides for every stage together, so your team can move from receipt to disclosure with a clear and defensible record.
What is the DSAR process, and how long do you have?
A data subject access request, or DSAR, is a request from an individual for a copy of their personal data and information about how it is used. Under UK GDPR you must normally respond within one month of receipt. You can extend that by up to two further months where the request is complex or the person has made several requests.
Handling a request well means treating each stage as its own task, with its own record of what was decided and why. The five stages below follow the order most data protection teams work in. Each one links to a guide that goes deeper.
| Stage | What happens | Start here |
|---|---|---|
| 1. Understand | Confirm what the person is asking for and which rules apply | Data Use and Access Act guide |
| 2. Scope | Narrow the search to the smallest safe review set | DSAR scoping guide |
| 3. Review and redact | Remove third party data and exempt material | DSAR redaction tool |
| 4. Apply exemptions | Decide what can lawfully be withheld, and record why | Exemption guides below |
| 5. Disclose and report | Deliver securely, then learn from the request | ProvePrivacy Lite |
Stage 1: How do you understand the request and the law?
Start by confirming what the person is asking for, who they are and which rules apply. The Data (Use and Access) Act 2025 amends the right of access, so your procedure should reflect the current law. These guides cover the legal background.
- Data Use and Access Act (2025): Essential Guide 2026 explains what has changed for data protection teams.
- DSAR management software for GDPR teams sets out why subject access requests matter and how to manage them.
- Brillen Rottler v TC and abusive DSARs looks at how the courts treat requests that may be abusive.
Stage 2: How do you scope a DSAR safely?
DSAR scoping is the work of narrowing a wide discovery set into the smallest review set that still gives the requester everything they are entitled to. Use documented filters, tested search terms and a scoping record that a named person signs off.
The free DSAR scoping guide sets out a six step method, the safe data reduction techniques and the pitfalls to avoid.
Stage 3: How do you review and redact the records?
Review and redaction is the stage that takes most time. Redaction removes third party data and exempt material while leaving the requester’s own data intact. Consistent decisions and a clear audit trail matter as much as speed.
- ProvePrivacy DSAR Redaction Tool shows how redaction works inside the ProvePrivacy platform.
- The Impact of AI on DSARs explores how AI is changing the volume and handling of requests.
Stage 4: Which exemptions can you apply to a DSAR?
A DSAR exemption lets you withhold some or all of the information requested. Apply each exemption case by case, and record the reason. These guides cover the main groups.
- Protecting third parties
- Legal professional privilege
- Crime, law and public protection
- Health and social care
- Finance, management and negotiations
- Regulatory, parliamentary and judiciary
- Journalism, research and archiving
- References and exams
Stage 5: How do you disclose, record and report on DSARs?
Disclosure should be secure and recorded, and every request should feed back into your management information. Reporting shows volumes, timeliness and exemption trends, and root cause analysis shows why requests go wrong.
- ProvePrivacy Lite covers DSAR and FOI handling with built in redaction.
- Release V8.1.0: New Reporting Centre introduces reporting across the ProvePrivacy platform.
- Data protection root cause analysis shows how to stop repeat risks, including DSAR failures.
How does the ProvePrivacy platform help with the DSAR process?
The ProvePrivacy platform is a GDPR compliance platform for busy data protection teams. It logs and manages DSARs in structured, auditable workflows, replacing spreadsheets and disconnected processes with one record of each request. Explore ProvePrivacy DSAR management software.
Frequently asked questions about the DSAR process
What is a DSAR?
A DSAR is a data subject access request. It is a request from an individual to see the personal data an organisation holds about them, together with details of how it is used and who it is shared with.
How long do you have to respond to a DSAR?
You must normally respond within one month of receiving the request. You can extend this by up to two further months where the request is complex or the person has made a number of requests.
Can you charge a fee for a DSAR?
Generally no. A DSAR is free of charge. You may charge a reasonable fee, or refuse to act, only where a request is manifestly unfounded or excessive.
What is DSAR scoping?
DSAR scoping is the process of deciding which people, systems, date ranges and documents must be searched and reviewed to answer a request. The aim is the narrowest safe review set. Download the free DSAR scoping guide for the full method.
