Data Subject Access Requests: What Marketing Teams Get Wrong Under GDPR

A data subject access request (DSAR) is a person asking what personal data you hold about them, and under GDPR Article 15 your marketing team has one month to answer it in full. The hard part is finding the person in every tool your campaigns touch, naming the ad platforms that received their data, and sending a real copy, not a CRM export. This guide covers what marketing teams most often get wrong, with a data map, a workflow and a checklist, as of October 2026.

1. Recognise the request, wherever it lands

An access request has no required form. The EDPB's Guidelines 01/2022 on the right of access (final version 2.1) say it is enough for a person to make clear they want to know what personal data you process about them. They do not have to mention the GDPR or Article 15, and they do not have to give a reason. "What do you have on me and where did you get my email?" sent in reply to a newsletter is a valid request.

Channels matter. For the EU, the EDPB says a request sent through a channel you provide is in general effective even if it is not your preferred data protection address, for example your general contact address or a customer's regular account manager. You are not obliged to act on a request sent to a random or clearly unrelated address if you have published a proper channel. The UK regulator goes further: the ICO says a request can be made verbally or in writing, to any part of the organisation, including through any social media site where you have a presence.

The practical rule: treat a request that arrives through your brand's social media messages, a reply to a campaign email, a chat widget or a sales rep's inbox as live, and forward it to whoever handles data protection the same day. Never send personal data back through a social channel; ask for a secure delivery address. The EDPB also recommends confirming receipt in writing with the dates of the response period.

2. The deadline: one month, counted from receipt

Article 12(3) requires you to act without undue delay and in any event within one month of receipt. From the EDPB guidelines:

• The clock starts when the request reaches one of your channels, not when the right person notices it. Two weeks in a social inbox are two weeks gone.
• Counting: a request received on 5 March is due by 5 April. With no matching date in the next month, the deadline is that month's last day; a deadline on a weekend or public holiday moves to the next working day.
• Extension: two further months are possible where necessary because of complexity or the number of requests, if you tell the person within the first month and give reasons. The EDPB calls this an exception that should not be overused.
• Pauses: if you have real doubts about identity, or you hold a large amount of data and ask the person to specify what they want (Recital 63), the time can be suspended until they reply, provided you asked without undue delay.

3. Where marketing data lives

The EDPB says you must search all IT and non-IT filing systems, using the keys each system is organised by (email, phone, customer number, user ID, cookie ID), including data your processors hold for you. Map this before a request arrives.

System	Search by	Typical personal data	Recipient to name in the reply
CRM	Email, phone, customer number	Contact record, lead score, deal stage, notes, call logs	The CRM vendor and anyone you export leads to
Email marketing platform	Email	List memberships, consent record, opens, clicks, unsubscribe status	The email platform vendor
Ad platform audiences	Records of which customer lists were uploaded, and when	Email or phone (often hashed before upload)	Each platform you uploaded to, by name (for example Google, Meta, LinkedIn)
Website pixels and tags	Cookie or device ID, if the person provides it	Event data sent to ad platforms	Each platform whose pixel fired for that visitor
Analytics	User or client ID linked to a known person	Page views, events, campaign source	The analytics vendor
Lead forms	Email, phone	Answers, consent checkbox, timestamp, source campaign	Form tool, plus any ad platform hosting a lead-gen form
Call and meeting recordings	Phone number, name	Audio, transcripts, sales notes	Recording or conferencing vendor
AI tools	Name, email, company in prompt history	Prompts with customer details, personalised outputs	The AI vendor and, where its terms list one, its model provider
Shared drives and spreadsheets	Name, email	Event lists, old campaign exports	Anyone outside your organisation the file was sent to

Two details catch teams out. First, pseudonymous data is still personal data. The EDPB's example: if you can link a cookie ID to a person to show them ads, you can link it to answer their request, and may ask them for that identifier. Second, the answer reflects the moment the request arrived. Data already deleted under your retention schedule cannot be provided, but the EDPB expects you to make sure nothing is erased while the request is being handled, and incorrect or unlawfully processed data must still be provided. Pause automatic deletion for that person until you have answered.

Recorded calls are a common blind spot: the French authority CNIL lists a recorded customer service call as data a person can ask for. If AI tools are in your stack, our post on GDPR and AI marketing tools covers what to check about prompts and vendor terms.

4. Identity checks without over-collecting

Article 12(6) lets you ask for more information only when you have reasonable doubts about who is asking. The EDPB says you cannot request more personal data than you need to authenticate the person, and the check must be proportionate to the data involved and the harm a wrong disclosure could cause.

• Use what you already have. A request from the email address on file, or from a logged-in account, is usually enough. The EDPB calls demanding an ID document from someone you have already authenticated disproportionate.
• Prefer a confirmation step: a link or code sent to the email or phone number already in your records.
• Avoid ID card and passport scans by default. The EDPB says they should generally not be considered an appropriate way to authenticate, and the CNIL says a photocopy is not needed where identity is already sufficiently established.

5. What the reply must contain

The reply has three parts: confirmation that you process the person's data, the data itself, and information about the processing. Article 15(1) lists that information:

1. the purposes (for example newsletter, retargeting, lead scoring);
2. the categories of personal data;
3. the recipients or categories of recipients, in particular any outside the EU;
4. the retention period, or the criteria used to set it;
5. the rights to rectification, erasure, restriction and to object;
6. the right to complain to a supervisory authority;
7. the source, if the data did not come from the person (a bought list, an event partner, an ad platform's lead form);
8. any automated decision-making, including profiling, under Article 22(1) and (4), with meaningful information about the logic and its likely consequences.

Article 15(2) adds the safeguards for transfers outside the EU, such as standard contractual clauses. Your privacy notice is a starting point, but the EDPB says the information may need tailoring to the processing actually carried out for this person.

Recipients means names (C-154/21)

On 12 January 2023, in Case C-154/21, Österreichische Post, the Court of Justice ruled that the person can obtain the actual identity of the recipients. Categories are enough only where recipients cannot (yet) be identified, or where you show the request is manifestly unfounded or excessive. The case was about marketing: the data had been offered to trading partners for marketing. So "advertising partners" will not do. Name the platforms you uploaded the person's data to and the vendors that process it; under Article 4(9) a recipient is anyone the data is disclosed to, whether a third party or not, so processors count.

A copy means a faithful reproduction (C-487/21)

On 4 May 2023, in Case C-487/21 (CRIF), the Court ruled that the copy under Article 15(3) must be a faithful and intelligible reproduction of all the person's data. A general description or list of categories is not a copy. Where context is essential to understand the data, the person can be entitled to extracts from documents or databases, or even whole documents, such as the email thread behind a sales note. Other people's data is handled by balancing their rights, which should not end in refusing everything; redact what would harm others (Article 15(4)) and still answer. Explain raw codes such as a lead score of "B2" or a segment ID.

Format and cost

The first copy is free. In Case C-307/22 (26 October 2023) the Court confirmed that no reasons are needed and that a fee is possible only for further copies. If the request came electronically, reply in a commonly used electronic format unless the person asks otherwise, through a secure channel.

Profiling and automated decisions

Most segmentation is not an Article 22 decision with legal or similarly significant effects. But if automated scoring decides, without human review, who gets an offer, a price or a contract, Article 15(1)(h) applies. In Case C-203/22 (Dun & Bradstreet Austria, 27 February 2025) the Court said the explanation must let the person understand which of their data were used and how; handing over an algorithm is not enough.

6. Joint controllers, processors and ad platforms

Where you and an ad platform are joint controllers for collecting data through a pixel on your site, Article 26(3) lets the person exercise their rights against either of you, whatever your arrangement says. Answer for the part you control (what was collected on your site, why, and which platform received it) and tell the person how to ask the platform about its own processing. Data your processors hold, such as the email platform or CRM, is part of your answer, and your data processing agreement should oblige them to help; our guide to data processing agreements explains that clause. See also our retargeting post.

7. When you can refuse or charge a fee

Article 12(5) allows you to refuse, or charge a reasonable fee, only for requests that are manifestly unfounded or excessive, in particular repetitive ones, and you must be able to demonstrate it. The EDPB reads both concepts narrowly: a request is not excessive because no reason is given, the language is rude, or the person plans to use the data in a claim against you.

On 19 March 2026, in Case C-526/24 (Brillen Rottler), the Court added a nuance. A person subscribed to an optician's newsletter and sent an access request thirteen days later. The Court held that even a first request can be excessive, and so abusive, where the controller shows it was made not to learn about the processing but to artificially create the conditions for a compensation claim. Public information about many similar requests and claims may be taken into account. The bar is high. If you refuse, Article 12(4) requires you to tell the person within one month why, and that they can complain to a supervisory authority and go to court. Keep the evidence.

8. A response workflow

1. Log it the day it arrives: date, channel, wording, deadline.
2. Acknowledge and, only if needed, ask for verification or clarification at once.
3. Check scope: all data or something specific? Combined with erasure or an objection?
4. Freeze deletion of that person's data until the reply is sent.
5. Search every system in your data map, including processors, with all known identifiers.
6. Compile the copy, explain codes, redact third parties.
7. Fill the template covering Article 15(1)(a) to (h) and 15(2), with recipients named.
8. Review and send securely, and record what was sent and when.
9. Handle the other parts (erasure, objection) under their own rules, keeping objectors on your suppression list.

9. Common mistakes

The EDPB's coordinated enforcement action on the right of access, reported on 20 January 2025 after 30 authorities looked at 1,185 controllers, found missing procedures, overuse of exceptions to refuse, and barriers such as excessive identification demands. In marketing teams that looks like:

• Ignoring a request because it came through social media or a sales rep.
• Sending a CRM export and forgetting the email platform, ad audiences and call recordings.
• Writing "marketing partners" instead of naming Google, Meta, LinkedIn or the vendors involved.
• Sending a summary table where the record itself is needed to make sense of the data.
• Letting automatic deletion run while the request is open.
• Refusing as "excessive" without evidence, or without mentioning the right to complain.

10. Checklist: what to do this week

• List every marketing system holding personal data, with its search key and owner.
• Record every ad platform and vendor that receives customer data, by name.
• Tell sales, support and social media staff to forward any data request the same day.
• Prepare a reply template covering Article 15(1)(a) to (h) and 15(2).
• Agree a verification method that uses data you already hold.
• Run a test request on a colleague's record and time it.

For lawful bases, retention and the rest of the picture, see our complete guide to GDPR-compliant marketing for European SMEs.

Where Adverizeo fits

Adverizeo does not handle access requests. It writes ad copy and gives every text ad a compliance score from 0 to 100 with suggestions, as a risk check rather than a legal guarantee; see our GDPR page or create a free account.

This article is general information, not legal advice.