A subject files a DSAR, what do I deliver and in what form?

A DSAR covers the data you hold on someone plus context: purposes, recipients, retention. GDPR sets a one-month deadline, extendable once by two months.

Try this first

1. 1Verify the requester's identity before you hand anything over. Ask for the minimum needed; an ID copy with masked national number and photo is acceptable, but only if other verification fails.
2. 2List every system the person could appear in: CRM, mail archive, tickets, phone logs, marketing tool, HR (for employees), CCTV footage if retained.
3. 3Deliver in a common electronic format. PDF or CSV works, add context for codes and fields.
4. 4Include the required info: purposes, categories, recipients (sub-processors and country), retention, source if not collected directly, and subject rights.
5. 5Carefully redact what you cannot share: data of others, trade secrets, or items covered by a legal exemption. Document what you held back and why.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.