Data Subject Access Request: The Copy Is Only Half of It

Most organisations answer a data subject access request by sending the data and stopping. Article 15 asks for the data and eight further pieces of information, and the omission is the most common defect in a DSAR response.

The data subject access request clock is also more forgiving than people think, and the grounds for refusing are far narrower.

What a data subject access request actually entitles someone to

Article 15(1) starts with confirmation — whether or not personal data concerning them are being processed. Where they are, the person gets access to the data and the following information:

• The purposes of the processing, and the categories of personal data concerned.
• The recipients or categories of recipient to whom the data have been or will be disclosed — in particular recipients in third countries or international organisations.
• The envisaged storage period where possible, or, if not, the criteria used to determine it.
• The existence of the rights to rectification, erasure, restriction and objection.
• The right to lodge a complaint with a supervisory authority.
• Where the data were not collected from the person, any available information as to their source.
• The existence of automated decision-making, including profiling under Article 22(1) and (4) — and, at least in those cases, meaningful information about the logic involved, plus the significance and the envisaged consequences for them.

Article 15(2) adds one more: where data are transferred to a third country or international organisation, the person has the right to be informed of the appropriate safeguards under Article 46 relating to the transfer.

The data subject access request limb that gets ignored

Point (h) — automated decision-making — is the one that gets left out most often, and it is the one increasingly likely to be the reason the request was made.

Where Article 22 automated decision-making is in play, the person is entitled to meaningful information about the logic involved and about the significance and envisaged consequences. “Meaningful” is the operative word: a statement that a model was used is not meaningful information about its logic.

As automated decisions spread into hiring, lending and pricing, this limb turns a routine data subject access request into a question about your system. Deciding in advance what you would say is a better position than drafting it in week three of a response.

The data subject access request clock, and the extension

Article 12(3) sets the timing: information on action taken without undue delay and in any event within one month of receipt.

That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. But the extension has a condition that is routinely missed: you must inform the person of the extension within one month of receipt, together with the reasons for the delay.

An organisation that goes quiet on a data subject access request, then responds in month two, has not taken a lawful extension. It has simply been late. The extension is available — it just has to be claimed inside the original month, in writing, with reasons.

If the request came by electronic means, the information should be provided by electronic means where possible, unless the person asks otherwise.

A data subject access request is free, with two exceptions

Article 12(5) is unambiguous: communications and actions under Articles 15 to 22 shall be provided free of charge.

There are exactly two routes to charging or refusing, and both are narrow.

Further copies. Article 15(3) requires the controller to provide a copy of the personal data undergoing processing. For any further copies requested, a reasonable fee based on administrative costs may be charged. The first copy is free.

Manifestly unfounded or excessive requests, in particular because of their repetitive character. Here the controller may charge a reasonable fee or refuse to act — and the Regulation adds the sentence that decides most disputes: the controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

“Difficult”, “voluminous” and “we suspect an ulterior motive” are not the test. If you refuse, you must be able to demonstrate why, and Article 12(4) requires you to tell the person the reasons, plus their right to complain to a supervisory authority and to a judicial remedy — within one month.

Redaction has a legal basis, and limits

Article 15(4) provides it: the right to obtain a copy shall not adversely affect the rights and freedoms of others.

That is the basis for redacting third-party personal data from a response. It is a genuine limit — but it limits the copy, not the whole request, and it protects others’ rights rather than the organisation’s convenience. Redacting an entire document because it is awkward is not what 15(4) provides for.

On identity, Article 12(6) allows the controller to request additional information necessary to confirm identity where there are reasonable doubts. Reasonable doubts — not a routine identity checkpoint applied to everyone as a delaying tactic.

How a DSAR connects to your other records

Where to start with a data subject access request

1. Build the response template around all of Article 15(1), not just the data extract.
2. Decide your Article 15(1)(h) answer in advance for any automated decision-making you operate.
3. Diarise the extension decision inside the first month, and notify with reasons if you take it.
4. Charge nothing by default. Fees apply only to further copies or a demonstrably excessive request.
5. Redact under 15(4) with a reason recorded per redaction.
6. Fix the search problem, because that is where the month actually goes.

This guide reflects Regulation (EU) 2016/679 as published on EUR-Lex, read at 16 August 2026.

The GDPR Toolkit provides 100+ editable templates including the data subject request procedure and response letters, the records of processing, the DPIA template and the legitimate interests assessment.