# Subject access request (DSAR)

A request from a person for a copy of the personal data you hold about them, which you must usually answer within one calendar month.

Source: https://sted.digital/docs/glossary/subject-access-request · Last reviewed 17 October 2026 · Strand Glossary

A subject access request (DSAR, for data subject access request) is a request from a person for a copy of the personal data you hold about them and the facts about how you use it. It can arrive by any channel, to anyone in your organisation, without naming the law, and you usually have one calendar month to answer.

## Where the term appears

UK GDPR Article 15 and EU GDPR Article 15 give the right of access: the data itself, plus its purposes, recipients, retention and source. In the UK, UK GDPR Article 12A, inserted by Data (Use and Access) Act 2025 section 76 from 5 February 2026, starts the month at the latest of receiving the request, any identity information you asked for, or any fee, and pauses it while you wait for clarification you reasonably need. UK GDPR Article 15(1A) limits the duty to a reasonable and proportionate search. In the EU the month runs from receipt (EU GDPR Article 12(3)). The [individual rights page](/docs/standards/gdpr/individual-rights-and-dsars) covers extensions and exemptions.

### One month is not 30 days

A request received on 3 March is due on 3 April, not 2 April. Auditors and regulators check the arithmetic, the date you recorded as the start, and that any extension by two further months was explained to the person within the first month.

## How Sted uses it

Sted's knowledge base includes a Data Subject Rights Request Record (REC-DSRR) under the Data Subject Rights Handling Policy (POL-DSR), with ten sections from the request and its identity check, through whether the right applies and the deadline, to what the reply told the person and which recipients were notified.
Records are part of the Full Management System plan.

## Related terms

- [Personal data](/docs/glossary/personal-data): what the person is entitled to see.
- [Controller and processor](/docs/glossary/controller-and-processor): the controller answers; a processor helps.
- [Data protection officer (DPO)](/docs/glossary/data-protection-officer): often the named contact for requests.
- [How to handle a subject access request](/docs/guides/data-subject-access-requests): the task, step by step.