Data Subject Access Request (DSAR)

A data subject access request is a formal request from an individual asking an organisation what personal data it holds about them and, depending on the right being exercised, to provide a copy, correct it, export it in a portable format, restrict its processing or delete it. The right exists under GDPR and has close equivalents in other regimes, and the operative detail for a SaaS company is that it comes with a statutory deadline measured in weeks, not a best-effort service expectation. For a B2B SaaS product the request usually arrives through a customer rather than directly from the individual, because the customer is the controller and the vendor is the processor. That distinction determines the obligation: the processor's job is to help the controller answer within the deadline, which in practice means having an export and deletion path that a support engineer can run without writing a migration. Contracts increasingly commit vendors to specific turnaround times for this assistance, so it becomes an engineering requirement rather than a legal one. The hard part is never the primary record. Personal data spreads: it sits in the main database, in analytics events, in logs, in search indexes, in caches, in the queue that has not drained, in backups, in the support tool, in the email provider, and in every sub-processor. A deletion that clears the users table and leaves an analytics warehouse untouched is not a deletion, and a data map that lists systems but not the fields inside them will not survive an audit. Backups are the recognised exception in most interpretations — the usual approach is to exclude them from immediate erasure while ensuring restored data is re-deleted, and to document that position rather than leave it implicit. Practical note: build the data map before the first request arrives and keep it in version control next to the schema, then implement export and erasure as tested code paths with an audit log of who ran them and when. Teams that answer DSARs by hand can usually manage the first one; the volume that breaks them is the routine trickle afterwards.