Question 1

What is a data subject access request (DSAR)?

Accepted Answer

A data subject access request (DSAR) is a formal request made by an individual — called a "consumer" under US state privacy laws — to a business asking it to disclose what personal data it holds about them. DSARs can also include requests to delete, correct, or port personal data, as well as requests to opt out of the sale of personal information or targeted advertising. Under laws like the CCPA/CPRA, VCDPA, CPA, and 17+ other state privacy laws, businesses are legally required to respond to verified DSARs within a specified timeframe.

Question 2

How long do businesses have to respond to a DSAR?

Accepted Answer

Most US state privacy laws require businesses to respond to DSARs within 45 calendar days of receiving a verified request. Iowa is the exception, allowing 90 days. Many states also allow a one-time extension of 45 additional days if needed (Florida allows only a 15-day extension, and Iowa allows no extension). The clock typically starts when the request is received, not when identity verification is completed.

Question 3

What information must be included in a DSAR response?

Accepted Answer

A DSAR response must include: confirmation of whether the business holds personal data about the requestor, the categories of personal data collected, the specific pieces of personal data held, the purposes for processing, the categories of third parties the data has been shared with, and information about the consumer's rights. For access requests under the CCPA, businesses must also disclose data sold or shared in the prior 12 months. Responses should be provided in a portable, readily usable format such as JSON or CSV.

Question 4

Do all US state privacy laws require DSAR processing?

Accepted Answer

Yes, all 20 comprehensive US state privacy laws that have been enacted as of 2026 include some form of consumer rights request processing (DSAR). However, the specific rights vary by state. For example, California (CCPA/CPRA) provides the broadest set of rights including access, deletion, correction, portability, and opt-out. Utah and Iowa are more limited — neither includes a right to correction. The response deadlines and extension periods also vary by state.

Question 5

Can a business charge a fee for processing a DSAR?

Accepted Answer

Under most US state privacy laws, businesses cannot charge a fee for processing DSARs. However, if requests are manifestly unfounded, excessive, or repetitive, some laws permit a reasonable fee to cover administrative costs or allow the business to decline the request. Under the CCPA/CPRA, businesses may charge a reasonable fee for a second copy of data within a 12-month period. Businesses must always provide at least one free response per consumer per year.

DSAR Request Manager

Step 1: Where does your business operate?