Data subject requests (DSAR)¶
DSARs (Data Subject Access Requests) are the requests by which a data subject exercises their rights.
Rights (request types)¶
| Right | What it is |
|---|---|
| Access | To know what data exists about you |
| Rectification | To correct incorrect data |
| Erasure | "Right to be forgotten" |
| Portability | To receive the data in a reusable format |
| Objection | To object to a processing activity |
| Restriction | To restrict the processing |
Each request¶
- Data subject, Type, Date, Deadline (1 month) and Status (Received / In progress / Completed).
Step by step¶
- GDPR → Requests tab.
- + Request (or it arrives via the Data Subject Portal).
- Handle the request and update the status.
Deadline
You have 1 month to respond. Requests that are overdue or due soon (≤7 days) show up in the Alerts.
Answering: two formats, two rights¶
On a contact's record there are two buttons, and they are not alternatives - they serve different rights:
| Button | Right | Why |
|---|---|---|
| GDPR report (PDF) | Access - art. 15 | The data subject is entitled to a copy of their data and to information in clear language (art. 12(1)). A PDF is the natural format |
| Export JSON | Portability - art. 20 | The law requires a structured, commonly used and machine-readable format. A PDF does not meet that requirement |
What the GDPR report includes¶
Listing the data is not enough. The document also carries what article 15(1) requires:
- the purposes and legal basis (a), the categories of data (b) and the recipients (c);
- the retention period (d) and the source of the data (g);
- the rights to rectification, erasure, restriction and objection (e) and the right to lodge a complaint with the supervisory authority (f);
- the existence of automated decision-making and profiling (h) - in the CRM, the lead score;
- identification of the controller and the DPO.
Best practice before handing it over¶
- Verify the identity of the requester (art. 12(6)) - answering the wrong person is itself a data breach.
- One month to reply, extendable by two more in complex cases (art. 12(3)).
- First copy is free (art. 15(3)).
- Minimise: only that person's data - never third-party data that shows up in the same notes.
- Secure channel for delivery and record the response (accountability, art. 5(2)). When you generate the report, if an Access request is open the CRM offers to mark it as completed.
Careful with internal notes
Notes the team writes in the CRM (e.g. "difficult customer") are personal data and appear in an access request. Good rule: only write what you would be willing to show the person.