How to handle a DSAR without missing the deadline

When noyb tested 121 data subject access requests (DSARs) it filed for its 2026 Digital Omnibus Reality Check, 83.5% were not answered in line with the law, and almost 30% got no answer at all.

That failure traces back to a shared cause, since most organizations cannot locate their own data fast enough to respond within the deadline. Only 61% have implemented data inventory and mapping, according to TrustArc's 2025 Global Privacy Benchmarks Report, and 55% do not continuously maintain a sensitive data inventory, according to the Netwrix 2026 Data and Identity Security Report.

That data-location problem plays out one request at a time. A DSAR can land in the shared privacy inbox on a Tuesday, and by Wednesday someone is emailing five department heads asking whether they have anything on Jane Smith.

The 45-day clock started the moment the request arrived, whether or not anyone has begun searching. A data index linking one person's identity to every place their data appears prevents each request from starting from zero.

Effective DSAR handling combines that visibility with a documented process for verification, discovery, review, redaction, delivery, and audit evidence.

What is a DSAR?

A data subject access request (DSAR) is a formal request from an individual to an organization for a copy of the personal data the organization holds about them. It also covers why the organization holds the data, who it shares it with, and how long it retains it.

Under Article 15 of the European Union's General Data Protection Regulation (GDPR), you can use any wording in the request. Phrases such as "subject access request" or "Article 15" are optional. Access is one of several subject rights, alongside correction, deletion, and portability.

In the United States, California's Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA) give you 45 calendar days to respond, extendable once by another 45, with a confirmation of receipt required within 10 business days.

Other U.S. state laws generally use the same 45-day window; Iowa's base window is 90 days, extendable once by 45 more. If your organization also serves EU residents, GDPR gives you one month from receipt, extendable by two further months when complexity or volume justifies it. If you extend, tell the requester why inside that first month.

Why DSAR fulfillment breaks down

The European Data Protection Board's (EDPB) 2024 Coordinated Enforcement Framework report, adopted Jan. 16, 2025, drew on 30 supervisory authorities examining 1,185 controllers. Four causes recur across their findings and mirror the operational patterns U.S. compliance teams see under CCPA.

Personal data is scattered with no single index

One employee's data sits in HR databases, customer relationship management (CRM) records, mailboxes, Teams chats, SharePoint libraries, file shares, and backups, with nothing linking them. An organization's record of processing activities (ROPA) will not point to those records, since it describes categories of processing rather than where any one person's data physically sits.

The International Association of Privacy Professionals has found that manual ROPAs built this way run incomplete and go stale, because they depend on every team accurately reporting what it processes. No technology exempts you from the right of access, and archived and backed-up data count.

Manual searches consume most of the response window

Without an index, someone searches system by system. When search eats weeks of a 45-day window, review is squeezed into the last few days, and a reviewer is still redacting on day 40. The EDPB's review of enforcement cases found that controllers routinely leave certain file types, formats, or data categories out of their replies, missing non-textual files, metadata, and backups in the process.

Identity verification and scoping add friction before work begins

GDPR lets you check identity only when you genuinely doubt who is asking, not as a routine step for every request, and CCPA similarly grades verification to the request's sensitivity.

Scoping the request calls for the same judgment, since the EDPB presumes a general request covers all personal data unless the requester expressly limits it. If a team cannot see what the organization holds, it cannot frame a sensible clarifying question, and the clock keeps running.

Manual redaction of third-party and exempt data is slow and risky

A response must leave out other people's data and anything a legal exemption covers. When done by hand, over-redaction breaches the right of access, and under-redaction leaks personal data.

Black-box highlighting in Word or Portable Document Format (PDF) files often leaves text readable underneath; file metadata preserves prior authors and tracked changes, and spreadsheets hide rows.

The DSAR response process, step by step

A documented, repeatable procedure is what separates DSAR fulfillment that holds up under audit from a scramble improvised for each new request, and a missing procedure is the first challenge the EDPB's Coordinated Enforcement Framework (CEF) report names.

The seven steps below reflect current EDPB and California Privacy Protection Agency (CPPA) expectations.

1. Log and acknowledge the request

Log every request as soon as it arrives, regardless of the channel. A DSAR is valid no matter how it arrives, including verbally, via web forms, or on social media, so record who received it, when, and through which channel.

Under EU GDPR, the day of receipt doesn't count, and a deadline falling on a weekend or public holiday moves to the next working day. Under CCPA, confirm receipt within 10 business days and state the deadline as day X to day Y.

2. Verify the requester's identity

Ask for formal ID only when you have documented reasonable doubt about who is asking. The EDPB's Guidelines 01/2022 treat a copy of an ID document as a weak way to confirm identity, since existing credentials such as a username and password already establish who is asking in most cases.

If you must request ID, tell the requester they can mask the photo and document number. California grades verification by what is requested, from a reasonable degree of certainty for routine requests to a reasonably high degree of certainty for sensitive personal information.

3. Scope what is being asked

If the request is vague and you hold a lot of information, ask the requester to narrow it, but keep working while you wait. Asking for clarification does not pause the deadline under GDPR, and CCPA doesn't pause the clock either. If the requester does not reply, interpret the original request and act on it.

4. Locate the data across every system it lives in

Search every in-scope system for sensitive data tied to the requester's name plus a stable identifier, such as a customer or employee number. The EDPB expects the search to cover every information technology system and non-IT filing system, not just the databases a team checks by habit.

CCPA regulations require a similarly thorough review that covers archived and backed-up data, workforce collaboration tools such as Teams and Slack, and personal devices used for work. Microsoft's own documentation confirms that data on local computers or on-premises file servers is outside its DSR tools, so your search list must name every file server and the tenant.

5. Review, redact, and apply exemptions

Apply a three-step test to third-party data before disclosing anything:

• Can you answer without identifying the third party?
• Has that person consented?
• If not, is disclosure reasonable without their consent?

Redact where possible and record what you withheld. Other exemptions commonly recognized across GDPR and U.S. state laws include legal professional privilege, ongoing negotiations, trade secrets, and confidential references, and each applies only when its specific conditions are met.

Under the EU GDPR, trade secrets and intellectual property can limit copying without refusing the request altogether. Use specific redaction software rather than highlighting tools, and provide a defensible reason for every redaction.

6. Package and deliver the response

Deliver the data in a format the requester can read without a data analyst. GDPR requires the response to be concise and transparent, written in language an ordinary reader can follow rather than a system export only IT would understand. If the request came in electronically, send a commonly used electronic form unless the requester asked for something else.

The Dutch Autoriteit Persoonsgegevens fined Uber €10 million in January 2024, citing a request process that was hard to use, response files in which personal data was not always structured and was difficult to interpret, and unclear disclosure of retention periods and data transfers. A raw export of database rows may not meet that bar.

7. Document what was done

Fill your DSAR log as you go, applying the same records management discipline your organization uses elsewhere, so an auditor can reconstruct the request without you. Record receipt date, handler, due date, actual response date, reasons for delay, information withheld and why, exemptions applied and by whom, and identity checks performed. Under CCPA, you must keep records of requests and responses for at least 24 months.

What it costs to get a DSAR wrong

DSAR enforcement follows three recurring patterns, covering missed deadlines, responses requesters cannot use, and identity verification demands the law does not allow. Regulators have fined organizations for each pattern.

Missing the deadline draws a direct fine

The Belgian Data Protection Authority fined a telecom operator €100,000 in August 2024 for replying 14 months after a DSAR request. GDPR caps fines for access failures at €20,000,000 or 4% of worldwide annual turnover, whichever is higher, and CCPA authorizes civil penalties of up to $7,500 per intentional violation.

That ceiling follows the same enforcement pattern seen across other GDPR fines, so a late response carries real exposure long before a case reaches it.

An incomplete or unclear response draws a fine too

The Dutch Data Protection Authority fined Netflix €4,750,000 in a November 2024 decision. The authority found that Netflix's privacy statement did not clearly explain the purposes, recipients, and retention periods, and that customers who asked what data Netflix held about them did not receive sufficient information, breaching the GDPR's right of access under Article 15. A timely response still creates liability if the requester cannot get the information they asked for.

Demanding more verification than the law allows creates its own liability

The Irish DPC reprimanded Groupon Ireland Operations Limited in March 2024 for requiring photographic ID when email verification was available, and no ID had been needed at signup. In 2025, the Dutch Council of State cut the fine against DPG Media from €525,000 to €262,500 while confirming that the company had acted negligently by demanding ID copies without examining whether a less intrusive alternative, such as email verification, was possible.

Regulators treat access-request handling as a routine enforcement priority

In California, the CPPA fined American Honda $632,500 in March 2025 for requiring at least eight data fields on every privacy request and denying at least 20 opt-out and limit requests by demanding verification the law did not permit. Subject access requests were the largest category of complaints to Ireland's Data Protection Commission (DPC) in 2025, at 42%, evidence that these cases are common rather than the exception.

What to look for when evaluating DSAR tooling

After the second or third scramble, most compliance leads start asking about DSAR software. That category covers the full request lifecycle, from capture and logging through identity verification, triage, collation, validation, and communication. Discovery decides how long step four takes, so evaluate it first.

Discovery across where your data lives

The tool should prove the presence of personal data at the file, row, and message level rather than relying on people to list systems in a questionnaire. Direct scanning provides that evidence; personal data discovery and classification should be primary criteria.

Hybrid coverage also matters because 77% of organizations operate in a hybrid IT environment, according to Netwrix's Cybersecurity Trends Report 2025.

In a Microsoft-heavy estate, check coverage of on-premises file servers, Exchange, SharePoint, and SQL Server alongside Microsoft 365, because Microsoft's own DSR guidance for Microsoft 365 treats on-premises file servers as out of scope.

Identity verification and intake built into the workflow

A single intake path should automatically log receipt, track the due date (including any CCPA acknowledgment window or GDPR extension notice), and enforce the verification tiers from step two so any ID request requires documented reasonable doubt.

Email-and-spreadsheet workflows put the audit burden on individual handlers to manually preserve timestamps, and evidence gets lost when someone leaves.

Redaction that does not require a manual pass on every file

Ask how the tool handles third-party names across 1,000 documents and whether its output is permanently redacted rather than reversibly obscured. Some eDiscovery tools' own documentation warns about limits on redaction metadata. A tool that flags third-party data and exempt categories before human review leaves reviewers the final week for judgment calls.

An audit trail produced automatically

The workflow should automatically generate an audit trail, logging every search, reviewer action, and delivery with actor and timestamp, so audit fields populate automatically. Check audit log retention against CCPA's 24 months.

How Netwrix helps you handle DSARs without the scramble

Netwrix Access Analyzer provides the data discovery, classification, and data access governance engine behind Netwrix DSPM, which brings those capabilities together for hybrid environments.

Knowing where personal data lives before a request ever arrives

Netwrix Access Analyzer discovers and tags personally identifiable information (PII) across hybrid environments, building the indexed inventory a DSAR workflow depends on before anyone submits a request.

It works across more than 40 supported data sources, including Windows file servers, SharePoint Online, SQL Server and Oracle.

Where the rest of the workflow lives

Netwrix DSPM supplies the discovery and access layer: where personal data sits and who can reach it. Request intake, identity verification, redaction, and the response log still belong in a privacy-request or ticketing workflow, so evaluate those against the criteria above.

Build a DSAR process that does not depend on a scramble

Building the index before a request arrives removes the need for the scramble, since search stops being the bottleneck and step four becomes a lookup instead of a manual sweep across every system. Start by classifying the stores where personal data concentrates, such as HR shares, mailboxes, and customer databases.

Then write the verification tiers and log template from steps two and seven, and run one practice request end to end to time it. If that drill shows the search is still eating the window, see how indexed discovery can search your data sources and preserve evidence for review.

Request a demo to see how Netwrix can help you index personal data across hybrid systems, run DSAR searches without manual system-by-system lookups, and automatically produce audit evidence.