How long do I have to respond to a data subject access request?
After a data subject files a DSAR with a data controller, the controller has a maximum of one month to fulfill a DSAR. If the data controller needs more time to fulfill the request, he/she must let the data subject know within the one month period. The controller may extend the DSAR processing period to two months, taking into account the complexity or quantity of requests a data subject has filed. However, the following reasons are unlikely to earn an organization an extension:
- If the request is manifestly unfounded or excessive
- An exemption applies
- The organization requests proof of identity before considering the request
- The organization has a lack of resources to fulfill DSARs
- Misplacing, losing, or forgetting about a DSAR
If the request isn’t fulfilled within that time frame, the data subject has the right to complain to the supervisory authority.
We have a tool that will help you stay on top of your DSARs, schedule a time to speak with us today.