How long do I have to respond to a data subject access request? 

After a data subject files a DSAR with a data controller, the controller has a maximum of one month to fulfill a DSAR. If the data controller needs more time to fulfill the request, he/she must let the data subject know within the one month period. The controller may extend the DSAR processing period to two months, taking into account the complexity or quantity of requests a data subject has filed. However, the following reasons are unlikely to earn an organization an extension:

  • If the request is manifestly unfounded or excessive
  • An exemption applies
  • The organization requests proof of identity before considering the request
  • The organization has a lack of resources to fulfill DSARs
  • Misplacing, losing, or forgetting about a DSAR

If the request isn’t fulfilled within that time frame, the data subject has the right to complain to the supervisory authority. 

We have a tool that will help you stay on top of your DSARs, schedule a time to speak with us today. 

Talk To Our Team

 

Disclaimer

This article is provided for general informational purposes only and is not intended to be legal advice.  By using the article, you agree that the information on this article does not constitute legal or other professional advice. The article is not a substitute for obtaining legal advice from a qualified attorney licensed in your state. The information on the article may be changed without notice and is not guaranteed to be complete, correct or up-to-date, and may not reflect the most current legal developments.