What is a data subject access request (DSAR)?

A data subject access request (DSAR) is the request a person makes to learn whether a company processes personal data about them and, if so, to get a copy along with the information listed in Article 15 of the GDPR, including purposes, categories of data, recipients, retention period, source and, where there is automated decision-making, meaningful information about the logic involved. The data subject, meaning the person the data is about, does not have to give a reason, and the first copy is free. The company has one month to respond, extendable by two more when requests are complex or numerous, as long as it tells the person, with reasons, within the first month. The Court of Justice of the European Union has held that the copy must be a faithful and intelligible reproduction of all the data, including extracts from documents where these are essential for exercising the other rights.

See also: GDPR and Artificial Intelligence · An AI system processing personal data remains fully subject to the GDPR: training, inference and output are all processing activities.

Where the data lives once AI is involved

The guidelines on access from the EDPB (the European Data Protection Board) treat activity logs as personal data and ask controllers to search all IT systems and to keep short-lived data from being erased while the request is pending. For a conversational assistant, the copy includes the prompts the customer typed and the answers received. Even the Hamburg data protection authority, which holds that the model itself stores no personal data, accepts access requests covering the system's inputs and outputs, though in a discussion paper that predates the EDPB opinion cited below and is not settled law.

Then comes the knowledge base wired to the assistant through RAG, the technique that retrieves documents and hands them to the model before it answers. The CNIL, the French regulator, notes that a system connected to a knowledge base makes it technically possible to exercise data subject rights and asks controllers to distinguish the model from the system: an answer naming a customer may come from the knowledge base, and whoever integrated it handles requests about it.

The model itself is in scope only if it is not anonymous, and under EDPB Opinion 28/2024 a model trained on personal data is not always anonymous and has to be assessed case by case. Where it is not, the CNIL acknowledges that finding a person's data in the model is hard today without pointers from that person, but for generative AI it recommends that the developer query the model with targeted prompts and hand over example outputs containing the person's data.

An enterprise example

An insurer runs a virtual customer service assistant, built on a vendor's model and a knowledge base of old support tickets. A customer asks for all their data, conversations included. The chat logs sit on the platform of the vendor, which handles them as a processor: they have to be exported, made readable and redacted only where the copy would adversely affect the rights of others. The insurer integrated the knowledge base, so it searches the customer's tickets and hands over extracts. For the model, which it did not train, the insurer names the source and refers the customer to the developer for anything it may have learned in training.

Why it matters for decision makers

The EDPB's coordinated enforcement action on the right of access (30 authorities, 1,185 controllers) recommends deciding in advance which systems and databases to check. With AI, the map comes before the first request: where logs and conversations end up, which vector database feeds the assistant, who in the company responds and how long each vendor keeps which data. Zero data retention shrinks what stays with the vendor and leaves in-house logs untouched. And the contract has to commit the vendor to assist the controller, as Article 28 of the GDPR requires, and to do so in time: the month runs from the request, not the vendor's reply.

This entry is informational and does not constitute legal advice: for decisions on regulated data, involve your DPO or legal counsel.