Data subject access request

A data subject access request is somebody exercising the right of access set out in Article 15 of the GDPR. They may ask whether you are processing personal data about them and, if you are, for a copy of it together with supplementary information: the purposes you hold it for, the categories it falls into, who you disclose it to, how long you intend to keep it, where it came from if you did not collect it from them, and whether it feeds any automated decision-making. There is no required form. A request can arrive in a support ticket, in an email to any address you publish, or as a sentence at the end of a complaint about something else.

The default deadline is one month from receipt, extendable by two further months where a request is genuinely complex or where somebody has made several, provided you tell the person inside that first month and explain why. It is normally free of charge. That timetable is what makes this an engineering concern rather than only a legal one: an organisation that has never built the export path discovers under a deadline that personal data is spread across a production database, an analytics platform, a support desk, a mailing tool and a folder of backups, with no single identifier joining them up.

What makes a request cheap to answer

• A written record of where personal data actually lives, kept current as systems are added, so the search is a checklist rather than an investigation.
• A repeatable export for each store, exercised at least once outside the pressure of a live request.
• An identity check proportionate to how sensitive the data is, so that answering one person does not hand another person’s record to a stranger.
• A rule for third-party data, because a copy provided under this right must not adversely affect the rights and freedoms of other people appearing in the same records.

The first access request a team receives is rarely difficult in law and almost always difficult in practice, because nobody has ever had to enumerate the systems before.