Data Subject Access Request
also called DSAR, SAR
An individual's request for a copy of the personal data an organisation holds about them, which must be fulfilled completely within a statutory deadline.
The requirement is straightforward and the engineering behind it is not: find everything about one person, across every system, within a month.
The difficulty is that personal data is rarely confined to a customer table. It is in the operational database, the analytical warehouse, the search index, the caches, the message queues, the application logs, the support ticketing system, the marketing platform, the backups, and the exports someone made to a spreadsheet. A response that covers only the systems the team remembered is incomplete, and completeness is the legal test.
What makes this tractable is architectural rather than procedural. A stable subject identifier that links records across systems, so a person can be located without fuzzy matching. A register of processing that lists which systems hold personal data and who owns them — required in any case under most regimes and usually the missing piece. And automation, because a manual process consuming days of engineering time per request does not survive volume, and volume rises whenever a company is in the news.
The related rights follow the same architecture: rectification, portability in a machine-readable form, restriction of processing, and objection. A system that can locate all of a person's data can serve all of them; one that cannot serve any.