GDPR | Data Subject Rights (DSAR)

Overview of data subject rights and how to implement them.

---

Rights Overview

Article	Right	Description
Art. 13/14	RIGHT TO INFORMATION	When obtained from the person (Art. 13); otherwise within Art. 14(3) time limits, subject to the applicable exceptions
Art. 15	RIGHT OF ACCESS	Copy of personal data undergoing processing, subject to Art. 15(4)
Art. 16	RIGHT TO RECTIFICATION	Correction of inaccurate data
Art. 17	RIGHT TO ERASURE (“right to be forgotten”)	Deletion of personal data
Art. 18	RIGHT TO RESTRICTION	Suspension of processing
Art. 20	RIGHT TO DATA PORTABILITY	Export of data in machine-readable format
Art. 21	RIGHT TO OBJECT	Objection to processing
Art. 22	RIGHT NOT TO BE SUBJECT TO AUTOMATED DECISION-MAKING	Safeguards for solely automated decisions with legal or similarly significant effects, under Article 22 conditions

---

Detailed Rights Overview

The SLA rows refer to the Article 12(3) information-on-action deadline. Rectification and erasure themselves must occur without undue delay where required; apply each right’s own conditions.

Art. 15 --- Right of Access

Aspect	Detail
What	Copy of personal data undergoing processing, subject to Art. 15(4) + metadata
When	Upon request from the data subject
SLA	one month (extension max +2 months)
Format	Commonly used electronic form for electronic requests, unless the person requests another means
Fee	First copy free; a reasonable fee based on administrative costs for further copies requested; Art. 12(5) separately governs manifestly unfounded or excessive requests

What you must provide under Article 15:

• Confirmation whether personal data are processed and, if so, access and a copy, respecting the rights and freedoms of others
• Purposes and categories of personal data
• Specific recipients to whom data have been or will be disclosed; categories where the person requests them, identification is impossible, or manifestly unfounded/excessive access is demonstrated (C‑154/21, paras. 43, 48–51)
• Retention period or the criteria used to determine it
• Rights to rectification, erasure, restriction and objection, and the right to complain to a supervisory authority
• Any available source information where data were not obtained from the person
• The existence of automated decision-making under Article 22(1) and (4), including meaningful information about its logic, significance and envisaged consequences
• Where transferred to a third country or international organisation, the appropriate Article 46 safeguards

Art. 16 --- Right to Rectification

Aspect	Detail
What	Correction of inaccurate or incomplete data
SLA	one month
Evidence	Assess inaccuracy and completion in light of the processing purpose; a supplementary statement is possible
Propagation	Inform recipients of the correction; unless impossible or disproportionate; identify recipients to the person on request (Art. 19)

Art. 17 --- Right to Erasure

Aspect	Detail
What	Deletion of personal data
SLA	one month (“without undue delay”)
Scope	Erase where an Article 17(1) ground applies, subject to Article 17(3); a backup schedule is not an independent extension of the erasure duty
Propagation	Inform recipients of the deletion; unless impossible or disproportionate; identify recipients to the person on request (Art. 19)

When erasure is not required, only to the extent processing is necessary (Art. 17(3)):

• Freedom of expression and information
• A binding retention/processing duty, a public-interest task or exercise of official authority
• Public health under Article 9(2)(h)–(i) and 9(3)
• Public-interest archiving, scientific/historical research or statistics under Article 89(1), where erasure would likely make the objectives impossible or seriously impair them
• Establishment, exercise or defence of legal claims

Where the controller made data public and must erase them under Article 17(1), Article 17(2) additionally requires reasonable steps to inform other controllers of the erasure request.

Art. 18 --- Right to Restriction

Aspect	Detail
What	Suspension of processing (data remains)
When	Contested accuracy while verified; unlawful processing where the person requests restriction instead of erasure; data no longer needed by the controller but needed by the person for legal claims; an Article 21(1) objection pending verification
SLA	one month
What is allowed	Storage; further use only with consent, for legal claims, another person’s rights or important EU/Member State public interest (Art. 18(2))

Before lifting restriction, inform the person; notify recipients subject to Article 19 conditions.

Art. 20 --- Right to Data Portability

Aspect	Detail
What	Export of data in machine-readable format
When	Data provided by the person, processed automatically on consent/contract; subject to Art. 20 limits
SLA	one month
Format	Structured, commonly used and machine-readable; JSON, XML and CSV are examples
Direct transfer	If technically feasible

Art. 21 --- Right to Object

Aspect	Detail
What	Objection to processing
When	On grounds relating to the person’s particular situation for Article 6(1)(e)/(f) processing; direct marketing has the separate Article 21(2) right
SLA	No further direct-marketing processing after objection; the Article 12(3) response period is not a grace period for continued processing
Consequence	For Article 21(1), stop unless you demonstrate overriding compelling legitimate grounds or need for legal claims; no such exception for direct marketing

Bring the right to object clearly and separately to the person’s attention by the first communication (Art. 21(4)). Research/statistics have the specific objection rule in Article 21(6).

Art. 22 --- Automated Decision-Making

Aspect	Detail
What	Right not to be subject to purely automated decisions
When	If the decision has legal or similarly significant effect
Rights	For contract/explicit-consent exceptions: at least human intervention, expression of views and contesting the decision; statutory authorisation must itself provide safeguards
Exceptions	Necessity for a contract; EU/Member State legal authorisation with safeguards; explicit consent. Special-category data additionally require Article 22(4)

---

Article 12(3): provide information on action taken without undue delay and within one month of receipt. A necessary extension of up to two further months is possible for complexity/number of requests; notify the person with reasons within the first month. Rights and exceptions must be assessed individually. A suggested internal acknowledgement target does not extend the legal deadline.

DSAR Workflow

Request Processing

The day ranges below are optional internal planning targets. Receive requests through accessible channels; additional identity information is justified only where necessary to resolve reasonable doubts under Article 12(6). Do not routinely require an ID document or wait for an internal milestone before acting.

---

Implementation

Technical Requirements

These are implementation examples, to be selected for the applicable right and risk. Distinguish processors (Article 28), joint controllers (Article 26) and other recipients; a DPA is not automatically required with every third party.

System	Requirement
Production DB	Export user data
CRM	Export customer data, delete capability
Marketing	Unsubscribe, delete, export
Analytics	Anonymisation or delete
Logs	Retention policy, pseudonymisation
Backups	Erasure process consistent with Article 17; prevent erased data being restored to use; no automatic backup grace period
Third-party	DPA, cooperation agreement

Data Subject Portal (Recommended)

Self-service portal for data subjects:

DATA SUBJECT PORTAL

Log in to manage your data

Action	Description
DOWNLOAD MY DATA	Access/copy under Article 15, respecting others’ rights
EDIT MY DATA	Correct inaccurate data
DELETE MY ACCOUNT	Submit an erasure request, subject to Article 17 grounds and exceptions
MANAGE CONSENTS	Manage given consents
CONTACT DPO	Contact the DPO where appointed, otherwise the controller’s rights contact

---

Response Templates

Access Request (Art. 15)

Subject: Response to personal data access request [DSAR-XXXX]

Dear [NAME],

[Confirm whether personal data are processed. If so, provide access and the copy below; adapt every applicable field.]

1. DATA CATEGORIES
   - Identification: [list]
   - Contact: [list]
   - Transactional: [list]

2. PURPOSES OF PROCESSING
   [list of purposes]

3. RECIPIENTS OF DATA
   [list of recipients]

4. RETENTION PERIOD
   [Retention period or criteria used]

5. YOUR RIGHTS
   You may request rectification, erasure or restriction and object to processing,
   subject to the applicable conditions; portability where Article 20 applies.
   You have the right to lodge a complaint with the supervisory authority.

6. SOURCE
   [If not obtained from you: all available source information]

7. AUTOMATED DECISION-MAKING
   [Whether Article 22(1)/(4) decisions occur; meaningful information about
   the logic, significance and envisaged consequences, where applicable]

8. INTERNATIONAL TRANSFERS
   [If transferred to a third country/international organisation: Article 46 safeguards]

Attachment: [file.zip]
Password sent separately.

Kind regards,
[Responsible controller contact; DPO where appointed]

Erasure Confirmation (Art. 17)

Subject: Confirmation of personal data erasure [DSAR-XXXX]

Dear [NAME],

[Confirm only erasure actually completed. Distinguish any outstanding action, its reason and date.]

DELETED DATA:
- Account and profile
- Transaction history
- Communications

RETAINED DATA (legal obligation):
- [Exact retained record, statutory basis, retention end date]

ERASURE STATUS BY SYSTEM:
- Production database: [DATE]
- Backups: [completed action/date; identify and explain any outstanding action]
- Third-party: [list]

Kind regards,
[Responsible controller contact; DPO where appointed]

---

Exceptions and Refusal

When You Can Refuse

Reason	Example
Cannot verify identity	The controller demonstrates inability to identify under Articles 11(2)/12(2); only necessary additional information may be requested on reasonable doubts (Art. 12(6))
Manifestly unfounded	Manifestly unfounded character demonstrated by the controller; repetition alone is not an automatic ground
Excessive request	Manifestly excessive under Article 12(5), demonstrated by the controller; size or repetition alone is not an automatic ground
Legal restriction	Identify an applicable legislative restriction meeting Article 23 conditions or a right-specific exception; an investigation or legal claim alone is not a blanket refusal ground

Obligations When Refusing

1. Inform the person of the reasons without delay and no later than one month after receipt (Art. 12(4))
2. Inform about the right to complain to the supervisory authority
3. Inform about the right to judicial remedy
4. Document the decision

---

DSAR Register

DSAR ID	Date received	Subject	Type	Status	Deadline	Response
DSAR-2026-001			Access
DSAR-2026-002			Erasure

---

KPIs

These are optional internal service targets, not measured results or statutory thresholds. Do not target a refusal rate; decide each request on its merits.

Metric	Target
Average response time	<20 days
Compliance rate (within one month)	100%
Customer satisfaction	>80%

---

Next Steps

1. Subject rights understood
2. Questions to assess your obligations
3. Implement DSAR workflow
4. DSAR template

---

Disclaimer

This content is for informational purposes only and does not constitute legal advice. For your organisation’s specific situation, we recommend consulting a qualified lawyer.

---

Content reviewed: 6 September 2026. Primary sources: GDPR — Arts. 3, 5, 6, 9, 12–22, 28–39, 83.