What is a DSAR (Data Subject Request)?

Definition

DSAR is an acronym for Data Subject Access Request: a request made by a data subject to exercise a right regarding the information that an organization holds about them. In Brazil, the term is used for any data subject request provided for in law. LGPD, not just access.

Data subject rights under the LGPD (Brazilian General Data Protection Law)

Article 18 of the LGPD guarantees the data subject the right to obtain from the controller, at any time and upon request:

• confirmation of the existence of treatment;
• access to data;
• correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data;
• Data portability to another provider;
• deletion of data processed with consent;
• Information about the entities with which the data was shared;
• information about the possibility of not giving consent and about the consequences of the refusal;
• revogação do consentimo.

Response deadlines

According to Article 19, confirmation of the existence of or access to data must be provided immediately, in a simplified format, or through a clear and complete statement within 15 days of the request date. Other requests follow the deadlines defined by ANPD regulations.

What good customer service needs to have

1. A clear channel for the holder to submit the request and track its progress.
2. Authentication from the applicant, so as not to give data to the wrong person.
3. Internal flow with assigned responsibilities and deadlines, since the response depends on various areas and systems.
4. Register of each step, as evidence of compliance.

How Privacy Tools fulfills requests

The module Management of Holders' Requests The system receives the request via form, authenticates the requester, generates a protocol, directs it to the correct workflow, and logs everything. Privacy Portal It is the channel through which the holder opens and tracks the request, and the integration with the Data discovery Locates the person's data in the company's databases.

Related terms

ROPA · RIPD · LIA · Back to glossary

Updated October 3th, 2026.