DSAR Readiness Checker

A Data Subject Access Request (DSAR) is a right under GDPR Article 15 that allows individuals to request access to their personal data. Organizations must respond within one month and provide information about what data they hold, how it is processed, and with whom it is shared.

Any organization that processes personal data of EU/EEA residents must comply with DSARs, regardless of where the organization is located. This includes websites with EU visitors, SaaS companies, e-commerce stores, and any service collecting user data.

The rights include: access (Art. 15), rectification (Art. 16), erasure/right to be forgotten (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and rights related to automated decision-making (Art. 22). Organizations should document all applicable rights in their privacy policy.

A Data Protection Officer (DPO) is required under GDPR Art. 37 for public authorities, organizations doing large-scale systematic monitoring, or processing special category data at scale. The DPO's contact details must be published and communicated to the supervisory authority.

Failure to respond to DSARs within the required timeframe or provide adequate information can result in complaints to supervisory authorities, investigations, and fines. Notable cases include fines against organizations that failed to respond within 30 days or provided incomplete responses.

We run a 7-point compliance checklist: privacy policy accessibility, DSAR contact email, rights exercise form, DPO contact information, data subject rights section completeness, response time commitment, and supervisory authority reference.