What is a DSAR (data subject access request)?

A DSAR, or data subject access request, is a request from an individual to an organisation for a copy of the personal data it holds about them. Under the UK GDPR it is also called a subject access request (SAR), and the right behind it is the right of access in Article 15.

The deadline

You must respond without undue delay and within one month of receipt. The ICO's guidance on responding to a request explains how to count it:

• The day you receive the request counts as day 1, even if it is not a working day.
• The deadline is the same date in the following month.
• If that date does not exist, for example 31 January to February, the deadline is the last day of that month.
• If the deadline falls on a weekend or bank holiday, you have until the next working day.

You can extend by up to two further months if the request is complex or the person has made several requests. You must tell them within the first month and give your reasons.

Fees

A DSAR is normally free. You can charge a reasonable fee only if the request is manifestly unfounded or excessive, or for further copies. If a request is manifestly unfounded or excessive, you can instead refuse it (Article 12(5)). See the ICO's guidance on manifestly unfounded or excessive requests.

What changed in 2026

The Data (Use and Access) Act 2025 made two changes to UK subject access:

• When the clock starts. New Article 12A sets the "applicable time period". The month runs from the latest of receiving the request, receiving ID information you asked for, or receiving a fee. You can stop the clock while you reasonably need information to identify the data or processing the request is about. This took effect on 5 February 2026. (DUAA s.76)
• How far you must search. New Article 15(1A) says the person is entitled only to what you can provide "based on a reasonable and proportionate search". This is treated as in force from 1 January 2024. (DUAA s.78)

These are UK changes. The EU GDPR has not changed in the same way. See UK GDPR for the wider context.

The hard part: finding the data

The deadline is rarely the problem. Finding every document that mentions a person, across contracts, emails saved as PDFs and scanned letters, is. A reasonable and proportionate search still has to be a real search.

DOCNUS can help with the search part. You can look a person up in the knowledge graph and see the documents and passages that mention them, ask questions in plain English with answers that cite the page, and use the privacy assessment to see which documents hold personal data and of what kind. DOCNUS does not manage DSAR cases, track deadlines, redact or export documents. Read more on using DOCNUS for DSARs, or the step-by-step guide on how to search documents for a subject access request.

This page is general information, not legal advice.