Managing Data Subject Access Requests (DSARs) across multiple jurisdictions can be challenging. If your company deals with customers in the EU, the UK, California, and other US states, you've likely faced questions about deadlines and processes. These questions often arise when a request lands in the wrong inbox or when you're unsure how to calculate a deadline. Here are the most common questions, answered directly.
Q1. Do we really have to run one process? The deadlines are all different.
Yes, create a single intake process and let the deadline logic branch from there. The right of access is a common feature in modern privacy laws, requiring you to confirm if you process a person's data and provide a copy with context about its use.
Deadlines vary: the GDPR allows one calendar month under Art. 12(3); the CCPA allows 45 calendar days under § 7021(b); most other US states also use 45 days, though Iowa allows 90 under § 715D.3. Canada's PIPEDA sets 30 days under s. 8(3), and Brazil's LGPD requires a response within 15 days under art. 19. Tag each request with its governing law at intake, then let your workflow calculate the due date based on that tag.
Q2. When does the clock actually start? Can we wait until we've verified the requester?
The start time varies by jurisdiction, and mistakes can lead to missed deadlines.
Under the GDPR, the clock starts when the request reaches an official channel. In California, the clock starts upon receipt, regardless of verification time. In the UK, since 5 February 2026, the month starts from the latest of the request, the ID you asked for, or a permitted fee.
Pausing for ID verification is specific to the UK. Applying this to a California request could make you late. Also, a request sitting unread in a general inbox is already consuming your time. Train your team to forward anything resembling an access request promptly.
Q3. Someone emailed our sales rep asking for "everything you have on me." Is that a valid DSAR?
Yes, it likely is. A request doesn't need formal language; it just needs a clear ask for personal data. The requester doesn't have to cite Article 15 or use your form.
Format rules differ: in the UK, requests can be verbal or via social media, while Canada's PIPEDA requires written requests. Offer a clear route, like a form or privacy address, and ensure staff forward requests received through other channels. A streamlined process helps meet deadlines.
Q4. What do we have to include in the response? Is it the same for the EU and California?
No, the requirements differ.
Under GDPR Art. 15, you must provide a copy of the data and details on processing purposes, data categories, recipients, sources, storage periods, the person's rights, and any automated decision-making. Art. 15(2) includes safeguards for transfers outside the EU.
California's § 1798.110 requires less: specific personal information, categories, purposes, sources, and third parties. It doesn't cover retention periods, other rights, or transfer safeguards. Automated decision-making access is separate under § 7021.
If you want a single response template, build it to the GDPR standard and trim for other jurisdictions. Rewriting for each jurisdiction is less efficient.
Q5. We're swamped. Can we extend the deadline?
Extensions are possible but limited, and you must notify the requester within the original timeframe.
The GDPR allows up to two additional months for complex or numerous requests, with notice and reasons in the first month. The UK follows the same rule. In California, you can extend by 45 days, with notice during the first 45. Most US states allow a 45-day extension with a reason given in the first 45. PIPEDA allows 30 extra days if the deadline would interfere with operations or requires consultation.
Quebec's Law 25 and Brazil's LGPD don't allow extensions, though small businesses in Brazil get more time. "We're busy" isn't a valid reason anywhere. Plan your capacity around the base deadline.
Q6. Can we charge a fee or refuse if the person is clearly using the DSAR for a legal dispute?
No, the first copy is free. The EU's top court confirmed in FT (C-307/22) that this applies even if the data is for a legal dispute. Requesters don't need to explain their reasons.
A reasonable fee is allowed under the GDPR for further copies or manifestly unfounded or excessive requests. California treats responses as free under § 1798.130, with no obligation to answer more than two requests in 12 months. Most US states offer at least one free response per year. "Manifestly excessive" is a high bar and requires documentation.
Where to go for more
Start with the EDPB's guidelines on the right of access for EU regulators' interpretations of Articles 12 and 15. For the UK, review the changes in the Data (Use and Access) Act 2025. For US states, check each statute's current deadlines and fee rules, as new laws frequently take effect.
Whatever tools you use, maintain discipline: a single intake channel, jurisdiction tags on every request, and due dates calculated from the strictest rule.
