GDPR Data Subject Access Request (DSAR) Guide for Non-EU Companies

Under GDPR Articles 15-22, EU data subjects have extensive rights over their personal data. For non-EU businesses, handling Data Subject Access Requests (DSARs) presents unique challenges — you must respond within 30 days, identify the correct individual, and provide complete data, all while operating from outside the EU.

What Rights Do Data Subjects Have?

• Right of access (Article 15): Confirmation of processing, categories of data, purposes, recipients, retention periods, source of data, existence of automated decision-making
• Right to rectification (Article 16): Correction of inaccurate data
• Right to erasure (Article 17): “Right to be forgotten” — deletion of data in specified circumstances
• Right to restriction (Article 18): Limiting processing while a dispute is resolved
• Right to data portability (Article 20): Receiving data in a machine-readable format
• Right to object (Article 21): Objecting to processing based on legitimate interests or direct marketing

DSAR Timeline and Process

You must respond without undue delay and within one month of receiving the request. Extensions of up to two additional months are possible for complex or multiple requests — but you must inform the data subject within the first month. The clock starts when you have sufficient information to identify the data subject.

Verifying Identity

Before responding to a DSAR, you must verify the identity of the requestor. You can request additional information if you have reasonable doubts about identity — but you cannot use identity verification as a delaying tactic. The verification process must be proportionate and data-minimized.

Fees and Refusals

DSARs are generally free. You can charge a “reasonable fee” only if the request is manifestly unfounded or excessive (particularly if it’s repetitive). You can refuse to act on a request only in limited circumstances — and you must inform the data subject of the reasons and their right to complain to the DPA.

Non-EU Business DSAR Checklist

1. Designate an EU Representative to receive DSAR inquiries
2. Set up an internal DSAR workflow (ticketing system)
3. Document data processing to enable quick search and retrieval
4. Define verification procedures
5. Train staff on 30-day timelines

Get your EU Rep from EUR 490/year →