Data subject access request (DSAR)

The controller must respond without undue delay and within one month, extendable by two further months for complex requests, and the response is free unless the request is manifestly unfounded or excessive. Because the deadline runs regardless of how the data is stored, the practical burden falls on being able to find everything about one person across every system quickly.

Article 15 is one of several rights that operate the same way. Rectification, erasure, restriction, portability and objection all carry the same deadline and the same requirement to be able to locate a person’s data. A platform that can answer one can usually answer all of them; a platform that cannot answer any turns each request into a manual project.

When the request concerns data an employer holds in a vendor’s system, the employer is the controller and owes the response. What the employer needs from the vendor is the ability to extract the data quickly and completely — which makes per-person export a procurement question rather than a nicety.