Data Subject Access Request (DSAR)

Data Subject Access Request (DSAR) is a right granted under modern privacy frameworks that lets an individual ask an organization to disclose the personal data it holds about them and explain how that data is collected, used, shared, and retained. DSARs matter to recordkeeping because fulfilling one requires the organization to locate, retrieve, and assemble personal information that may be scattered across structured systems, email, shared drives, and backups. Strong records management practices, such as accurate metadata, a maintained file plan, and a defined retention schedule, make a request far easier to answer completely and on time. A DSAR also intersects with disposition: data kept past its retention period expands the search burden and the organization’s exposure. Note the distinction from a freedom-of-information request, which typically targets government records held in the public interest rather than an individual’s own personal data. Responses often require redaction to protect third parties whose information appears in the same records, balancing the requester’s access right against others’ privacy.