Europe has a new office sport, and no, it is not competitive espresso drinking. It is the Data Subject Access Request, better known as the DSAR. Across the continent, individuals are asking companies, employers, banks, platforms, retailers, insurers, hospitals, and app providers a simple but powerful question: “What personal data do you have about me?”
That question may sound harmless enough. It is not a cyberattack. It is not a lawsuit. It does not arrive wearing sunglasses and carrying a briefcase. But under the General Data Protection Regulation, a Data Subject Access Request can trigger a serious legal, operational, and reputational challenge. Organizations generally must confirm whether they process a person’s data, provide access to that data, explain why it is used, identify who receives it, and do all of this within a tight deadline.
The rise in DSARs in Europe reflects a bigger shift: people are no longer treating privacy as a dusty policy link hiding in the footer of a website. They are treating it as a consumer right, an employment tool, a negotiation lever, and sometimes a flashlight pointed directly into the company basement where old spreadsheets go to retire.
What Is a Data Subject Access Request?
A Data Subject Access Request is a formal request from an individual asking an organization to disclose the personal data it holds about them. Under GDPR Article 15, the right of access allows a person to ask whether their personal data is being processed and, if so, to receive a copy of that data along with information about the purposes of processing, categories of data, recipients, retention periods, and related rights.
In plain English, a DSAR says: “Show me what you know about me, why you have it, where it came from, who you shared it with, and how long you plan to keep it.” That is a lot of showing. For a small business with tidy records, it may be manageable. For a multinational company with customer service logs, HR files, CRM notes, marketing databases, security footage, Slack exports, email archives, analytics systems, and a mysterious folder named “final_final_v3_REAL,” it can become complicated quickly.
Why DSARs Are Rising Across Europe
The growth of Data Subject Access Requests in Europe is not happening because people suddenly developed a hobby for legal correspondence. Several forces are pushing DSAR volumes upward at the same time.
1. Privacy Awareness Has Gone Mainstream
GDPR changed the public conversation around privacy. Before 2018, many consumers knew companies collected data, but the details felt foggy. Today, people are more likely to understand that personal data has value and that privacy rights are enforceable. News about data breaches, tracking technologies, artificial intelligence, and targeted advertising has made the average person more alert. Nobody wants to be the main character in a data leak.
Privacy tools, cookie banners, mobile app permissions, browser warnings, and public enforcement actions have all helped educate users. Some of that education has been accidental. After clicking “reject all” on cookie pop-ups for the 400th time, a person begins to suspect that a lot of data collection is happening behind the curtain.
2. Employees and Former Employees Are Using DSARs More Often
One major driver is the increase in employee DSARs. Workers and former workers may submit access requests during disputes, layoffs, performance reviews, disciplinary actions, discrimination concerns, or severance negotiations. In employment contexts, the DSAR is often less about curiosity and more about evidence.
An employee may ask for emails mentioning their name, HR records, performance notes, internal messages, payroll information, or data used in workplace monitoring. Employers then face a delicate task: they must provide the requester’s personal data while protecting the privacy rights of coworkers, managers, customers, and other third parties. That means review, redaction, legal judgment, and usually more coffee than anyone originally budgeted for.
3. AI and Automated Decision-Making Are Increasing Concern
Artificial intelligence has made DSARs more important. When companies use algorithms for hiring, credit scoring, fraud detection, advertising, workplace analytics, or customer segmentation, individuals want to know what data fed the machine and how that data affected them.
People are not only asking, “What data do you have?” They are also asking, “Did an automated system make a decision about me?” and “Was my profile used to train, score, rank, target, or reject me?” These questions are especially sensitive in Europe, where privacy, fairness, transparency, and fundamental rights are closely connected.
4. Data Breaches Create Request Surges
After a data breach, DSARs often increase. A breach notification may tell individuals that their information was exposed, but many people want more detail. Was it their email address? Their national ID number? Their health information? Their salary history? Their customer support complaint about a blender that sounded like a helicopter?
When trust breaks, curiosity becomes urgency. A company that has poor data mapping before a breach may find itself dealing with two emergencies at once: incident response and a wave of access requests.
Why DSARs Are Harder Than They Look
At first glance, a DSAR seems simple. Find the data, send the data, move on. In practice, it is more like trying to clean out a garage with a stopwatch running while a regulator watches from the driveway.
Data Lives Everywhere
Modern organizations store personal data across many systems: email, cloud drives, HR software, ticketing platforms, billing tools, call recordings, marketing automation systems, identity platforms, security logs, and archived backups. The more fragmented the data environment, the harder it is to locate everything relevant.
This is why data inventories and records of processing activities matter. If a company does not know where personal data lives, responding to DSARs becomes a treasure hunt, except the treasure is regulatory risk.
Identity Verification Must Be Careful
Before releasing personal data, organizations must verify that the requester is truly the person they claim to be. That sounds obvious, but it can be tricky. Ask for too little verification, and the company risks disclosing data to an impostor. Ask for too much, and the company may collect unnecessary personal data or frustrate the requester.
The best approach is proportionate verification. A bank may need stronger checks than a newsletter publisher. A health care provider should be especially cautious. A pet store probably does not need a passport scan to confirm someone bought a squeaky duck toy in 2022.
Third-Party Rights Must Be Protected
DSAR responses often contain information about more than one person. An employee’s file may include manager comments. A customer complaint may mention staff names. An email chain may include confidential business information or legal advice. Organizations must review and redact carefully to avoid harming the rights and freedoms of others.
This is where many DSARs slow down. Search is only the beginning. Review is the real marathon.
Deadlines Are Tight
Under GDPR and UK GDPR frameworks, organizations generally must respond without undue delay and within one month. In complex cases, or when multiple requests are made, the deadline may be extended by up to two additional months, but the requester must be informed. That timeline is not generous when a DSAR touches thousands of emails, multiple business units, and a legal team already surviving on calendar reminders.
Industries Feeling the Pressure
Some sectors are especially exposed to rising DSAR volumes because they collect sensitive, high-volume, or decision-critical personal data.
Employers and HR Teams
Employers may hold recruitment data, performance reviews, disciplinary records, payroll files, benefits information, workplace monitoring logs, and internal communications. A single employee DSAR can require coordination between HR, legal, IT, security, and department managers.
Financial Services
Banks, lenders, insurers, and fintech companies process identity documents, transaction histories, credit data, fraud flags, risk scores, call recordings, and app usage data. Because financial decisions can significantly affect individuals, access requests in this sector may be particularly sensitive.
Health Care and Life Sciences
Health data is among the most sensitive categories of personal data. Hospitals, clinics, pharmacies, research companies, and health apps must handle requests with extra care. A DSAR involving medical records is not just paperwork; it may involve deeply personal information about someone’s body, family, treatment, and future.
Technology Platforms and Retailers
Digital platforms and e-commerce companies often process large amounts of behavioral data: clicks, searches, purchases, preferences, location signals, device identifiers, and advertising segments. Users increasingly want to know how this information shapes recommendations, prices, ads, and account treatment.
What Rising DSARs Mean for European Compliance
The rise in DSARs signals that privacy compliance can no longer be treated as a once-a-year policy update. It must become an operational capability. Companies need processes that work on an ordinary Tuesday, not just when consultants are in the building and everyone is wearing their “governance” face.
Strong DSAR management includes clear intake channels, trained staff, request logging, identity verification, data discovery, legal review, redaction procedures, response templates, escalation paths, and documentation. The goal is not merely to answer requests. The goal is to answer accurately, securely, consistently, and on time.
How Companies Can Prepare for More DSARs
Build a Data Map Before the Request Arrives
A data map shows what personal data the organization collects, where it is stored, why it is used, who can access it, who receives it, and how long it is retained. Without a data map, every DSAR begins with panic archaeology.
Create a Clear DSAR Workflow
Companies should define who receives requests, who verifies identity, who searches systems, who reviews records, who approves redactions, and who sends the final response. The workflow should include deadlines, responsibilities, and escalation rules.
Train Front-Line Staff
A DSAR does not have to include magic words. A customer saying, “Send me all the information you have about me,” may be making a valid request. Front-line staff in customer service, HR, sales, and support should know how to recognize and route DSARs quickly.
Use Automation Carefully
Privacy technology can help manage DSAR intake, identity verification, data discovery, task tracking, and response documentation. Automation is useful, but it should not replace judgment. Human review is still essential where sensitive data, third-party information, legal privilege, or complex employment records are involved.
Reduce Unnecessary Data
The easiest data to disclose is the data you never collected. The easiest archive to search is the one you responsibly deleted. Data minimization is not just a GDPR principle; it is also a gift to your future self. Keep what you need, protect it well, and delete what has outlived its purpose.
Common DSAR Mistakes to Avoid
Organizations often stumble when they treat DSARs casually. Common mistakes include ignoring informal requests, missing deadlines, over-collecting identity documents, failing to search all relevant systems, disclosing third-party data, sending poorly redacted files, or providing vague explanations that sound like they were assembled by a sleepy robot.
Another major mistake is assuming that a difficult requester can be ignored. Some requests may be excessive or manifestly unfounded, but that conclusion requires careful justification. A company should not reject a DSAR simply because the person is angry, persistent, or writes emails with the emotional temperature of a toaster fire.
Specific Example: The Former Employee Request
Imagine a software company in Germany lays off a sales manager. Two weeks later, the former employee submits a DSAR asking for all personal data held by the company, including emails, performance notes, HR records, compensation data, internal messages, and information used to evaluate their role for redundancy.
The company must first verify identity. Then it must identify relevant systems: HR software, payroll, email, chat tools, document storage, performance management platforms, and possibly meeting notes. Legal and HR teams must review the data to separate the requester’s personal data from confidential business information and other people’s data. Some information may need redaction. Some may be exempt. The response must be clear, complete, and timely.
This example shows why DSAR readiness is not just a privacy-team issue. It is an enterprise issue. HR, IT, legal, compliance, security, and business managers all have a role to play.
Specific Example: The Consumer App Request
Now imagine a French consumer uses a fitness app for three years. After reading about AI profiling, she sends a DSAR asking what data the app holds, whether her location data was shared with advertisers, whether health-related inferences were created, and whether automated recommendations were based on sensitive information.
The app provider must understand its own data ecosystem. Does it store GPS routes? Device identifiers? Heart rate data? In-app behavior? Ad segments? Third-party analytics events? If the company cannot answer these questions internally, it will struggle to answer the user externally.
The Business Case for Better DSAR Management
Good DSAR handling is not only about avoiding penalties. It can improve customer trust, employee confidence, data governance, security posture, and operational discipline. A company that can respond to DSARs well usually has better control over its data. That control helps with breach response, vendor management, AI governance, retention policies, audits, and regulatory inquiries.
In other words, DSARs are not merely administrative chores. They are stress tests for the organization’s privacy maturity. If the DSAR process collapses under pressure, the company has learned something important. Preferably before a regulator learns it first.
Field Notes: Practical Experiences From DSAR Handling
In real-world privacy operations, DSARs often reveal the gap between policy and practice. A company may have a beautiful privacy notice, a polished compliance deck, and a data protection officer with heroic spreadsheet skills. Then the first serious DSAR arrives and everyone discovers that personal data is scattered across more systems than expected.
One common experience is the “inbox surprise.” A request arrives through a general customer service email, not the official privacy portal. Someone in support reads it, thinks it is a normal complaint, and replies with a friendly but irrelevant answer. Ten days later, legal hears about it. The deadline clock, unfortunately, did not wait for the internal forwarding ceremony. This is why training matters. The organization’s DSAR process is only as strong as the first person who sees the request.
Another practical lesson is that search terms can be messy. If a person is named Jonathan Smith, records may refer to “Jonathan,” “Jon,” “J. Smith,” an email address, an employee ID, a customer number, or a username from 2019 that nobody recognizes anymore. Good DSAR handling requires careful search logic. It also requires documenting what was searched and why. When the requester or regulator asks how the company found the data, “we clicked around a bit” is not a confidence-building answer.
Redaction is another area where theory meets chaos. A file may contain the requester’s personal data mixed with a coworker’s medical leave information, a manager’s opinion, a customer’s complaint, and confidential commercial strategy. The privacy team must decide what can be disclosed, what must be withheld, and what should be explained. Over-redaction can make the response useless. Under-redaction can violate someone else’s privacy. The sweet spot is somewhere between a black rectangle festival and a data spill.
Many teams also discover that retention policies are more than decorative documents. If old data is kept forever, DSAR searches become larger, slower, and riskier. An outdated performance note from seven years ago may suddenly resurface in a request, raising questions about why it was still retained. A disciplined deletion program can make DSARs easier while reducing privacy risk.
Finally, tone matters. A DSAR response should be professional, clear, and respectful. People submit requests because they want transparency. Some are worried. Some are angry. Some are simply curious. A confusing response full of legal fog can turn a manageable request into a complaint. A clear response, even when some data must be withheld, can reduce tension. Privacy is not only a legal function; it is also a trust function. The best DSAR teams understand both.
Conclusion
Data Subject Access Requests are rising in Europe because privacy has become personal, practical, and visible. Consumers want to understand how companies use their information. Employees want transparency in workplace decisions. Data breaches, AI systems, digital advertising, and automated profiling have made people more aware of what is at stake.
For organizations, the message is clear: DSAR readiness is no longer optional. A strong process protects the company, respects individuals, and strengthens data governance. The businesses that succeed will not be the ones that treat DSARs as annoying paperwork. They will be the ones that treat them as a direct test of accountability.
And accountability, unlike an old tracking cookie, is not something you can quietly hide in the corner and hope nobody notices.
SEO Metadata
Note: This article is for informational publishing purposes only and should not be treated as legal advice. Organizations handling Data Subject Access Requests should consult qualified privacy counsel or a data protection professional for case-specific guidance.
