What is a Data Subject Access Request?
A data subject access request (DSAR) is a right granted under Article 15 of the GDPR. It allows any individual to request a copy of the personal data an organisation holds about them, along with information about how that data is being processed.
DSARs can come from customers, employees, former employees, suppliers, or any individual whose data the organisation processes. The request can be made verbally or in writing, and the organisation cannot require the individual to use a specific form or channel.
The scope of a DSAR can be broad — covering emails, documents, database records, call recordings, and any other medium in which personal data is stored. For organisations handling large volumes of data, locating and preparing the responsive documents is a significant operational burden.
Data Subject Access Request Time Limit and Response Time
Under GDPR, organisations must respond to a data subject access request within one calendar month of receipt. This is not a working-day calculation — the clock starts on the day the request is received, regardless of when it is acknowledged.
For complex or voluminous requests, the deadline can be extended by a further two months (three months total). However, the organisation must notify the data subject of the extension and the reasons within the initial one-month period.
Missing the deadline carries consequences. Data protection authorities can impose fines, and the individual can lodge a complaint. In Ireland, the Data Protection Commission has investigated and sanctioned organisations for late DSAR responses. In the UK, the ICO takes a similar approach.
The tight timeline is what makes DSAR redaction so operationally challenging. Organisations must locate all relevant documents, review them for exempt material, apply redactions consistently, and prepare the response package — all within 30 days.
The Data Subject Access Request Redaction Challenge
Responding to a DSAR is not simply a matter of handing over documents. Before disclosure, every document must be reviewed and redacted to protect information that the organisation is not required — or not permitted — to disclose.
Third-party personal data is the most common category requiring redaction. If a document contains the requesting individual's data alongside the personal data of other people (colleagues, customers, family members), the third-party data must be redacted unless there is a lawful basis for its disclosure.
For a single DSAR, the responsive document set might include dozens or hundreds of files — emails, reports, forms, call notes, letters. Each must be individually reviewed. For organisations receiving DSARs at volume (particularly in financial services and healthcare), the manual effort quickly becomes unsustainable.
Data Subject Access Request Exemptions
GDPR and national data protection laws provide several exemptions that allow organisations to withhold information from a DSAR response. Applying these exemptions correctly requires careful judgement — and accurate redaction.
Third-Party Personal Data
Where a document contains personal data of other individuals, this must be redacted unless the third party has consented to disclosure or it is reasonable to disclose without consent.
Legal Professional Privilege
Communications between an organisation and its legal advisers that are made for the purpose of seeking or giving legal advice are exempt from disclosure.
Prejudice to Investigations
Information can be withheld if disclosing it would prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or ongoing regulatory investigations.
Commercially Sensitive Information
Trade secrets and commercially confidential information may be withheld where disclosure would cause serious harm to the organisation's commercial interests, provided the exemption is applied narrowly.
Management Forecasting & Planning
Information processed for management forecasting or planning may be exempt where disclosure would prejudice the conduct of the business.
Manual vs Automated DSAR Redaction
The difference between manual and automated DSAR processing is significant — both in time and in consistency.
Manual Redaction
- •Hours to days per request depending on document volume
- •Inconsistent redaction across reviewers
- •Risk of missed PII or over-redaction
- •Limited audit trail for redaction decisions
- •Does not scale with request volume
Automated Redaction
- •Minutes to process, with human review on top
- •Consistent rule application across all documents
- •Comprehensive PII detection reduces missed items
- •Full audit trail for every redaction
- •Scales with volume — same effort per request
How ComplyLoft Redaction Supports DSAR Compliance
The ComplyLoft Redaction tool automates the most time-consuming part of DSAR processing — identifying and redacting PII across document sets. It can reduce the manual workload for a DSAR response by up to 90%.
- •Upload the responsive document set and run automated PII detection across all files
- •Apply redaction rules consistently — third-party names, contact details, identifiers, and other PII categories
- •Review flagged items and remove any redactions that are not applicable
- •Generate a complete audit trail documenting every redaction decision
- •Download the redacted output as a single consolidated PDF ready for disclosure
ComplyLoft automates the groundwork of DSAR redaction. A qualified human must always review, confirm, and sign off on all redactions before disclosure. ComplyLoft does not guarantee compliance.
Data Subject Access Requests by Sector
DSAR volumes, complexity, and redaction requirements vary significantly by industry.
Financial Services
Banks, insurers, and investment firms handle DSARs involving account records, transaction histories, correspondence, and internal assessments. Document volumes are typically high and contain dense PII.
Healthcare
Hospitals and healthcare providers handle DSARs involving patient records, clinical notes, referral letters, and multi-disciplinary team communications. Sensitivity is exceptionally high.
Public Sector
Government departments and public bodies handle both DSARs and FOI requests, often with overlapping document sets. Redaction requirements intersect with FOI exemptions.
Public sector compliance →