--- title: "Understanding Subject Access Requests (DSAR): Best Practices and Penalties" description: "Understanding Subject Access Requests (DSAR): Best Practices and Penalties." image: https://eyd.tech/hubfs/AdobeStock_856935814_linkedin.png --- [Skip to content](https://eyd.tech/en/news-updates/understanding-subject-access-requests-dsar-best-practices-and-penalties#main-content) [![logo_white_480-3](https://eyd.tech/hs-fs/hubfs/logo_white_480-3.png?width=60&height=48&name=logo_white_480-3.png "logo_white_480-3")](https://eyd.tech/no/?hsLang=en) - [Home](https://eyd.tech/home) - Services Show submenu for Services - [Subject Access Requests](https://eyd.tech/subjectaccessrequest) - [Consent Management](https://eyd.tech/consent) - [Privacy Maturity analysis](https://eyd.tech/maturityanalysis) - About us Show submenu for About us - [Get in touch](https://eyd.tech/getintouch) - [The board](https://eyd.tech/board) - [News](https://eyd.tech/no/news-updates) - [Podcast](https://eyd.tech/podcast) - [FAQ](https://eyd.tech/faq) - Log in Show submenu for Log in - [Company](https://company.eyd.tech/auth/login) - [Personal](https://me.eyd.tech/auth/login) Open main navigation Close main navigation - [Home](https://eyd.tech/home) - Services Show submenu for Services - [Subject Access Requests](https://eyd.tech/subjectaccessrequest) - [Consent Management](https://eyd.tech/consent) - [Privacy Maturity analysis](https://eyd.tech/maturityanalysis) - About us Show submenu for About us - [Get in touch](https://eyd.tech/getintouch) - [The board](https://eyd.tech/board) - [News](https://eyd.tech/no/news-updates) - [Podcast](https://eyd.tech/podcast) - [FAQ](https://eyd.tech/faq) - Log in Show submenu for Log in - [Company](https://company.eyd.tech/auth/login) - [Personal](https://me.eyd.tech/auth/login) [Get started](https://eyd.tech/no/kom-i-gang?hsLang=en) --- [All posts](https://eyd.tech/en/news-updates/all) March 10, 2025 # Understanding Subject Access Requests (DSAR): Best Practices and Penalties ![Picture of EYD privacy](https://app.hubspot.com/settings/avatar/adfca0c37ac106ac130d5671ddf5bda2) By  [EYD privacy](https://eyd.tech/en/news-updates/author/eyd-privacy)  ·  3 minute read *In today’s data-driven world, the importance of data privacy cannot be overstated. One of the key components of data privacy regulations, such as the General Data Protection Regulation (GDPR), is the Data Subject Access Request (DSAR). This article delves into the best practices for handling DSARs and the potential fines for non-compliance.* #### What is a DSAR? A Data Subject Access Request (DSAR) is a request made by an individual to an organization, asking for access to their personal data. [Under regulations like the GDPR, organizations are required to provide this information within a specified timeframe, usually one month](https://www.ey.com/en_gl/insights/forensic-integrity-services/how-to-comply-with-data-subject-access-requests)[1](https://www.ey.com/en_gl/insights/forensic-integrity-services/how-to-comply-with-data-subject-access-requests). #### Best Practices for Handling DSARs 1. **Establish a Clear Process**: Organizations should have a well-defined process for handling DSARs. [This includes identifying the request, verifying the identity of the requester, and ensuring the data is provided within the legal timeframe](https://blog.didomi.io/data-subject-access-request-dsar-the-complete-guide)[2](https://blog.didomi.io/data-subject-access-request-dsar-the-complete-guide). 2. **Use Technology**: Leveraging technology can streamline the DSAR process. [Automated tools can help in locating and compiling the requested data, reducing the time and cost involved](https://www.ey.com/en_gl/insights/forensic-integrity-services/how-to-comply-with-data-subject-access-requests). 3. [**Train Employees**: ](https://blog.didomi.io/data-subject-access-request-dsar-the-complete-guide)Regular training sessions for employees on data privacy laws and DSAR procedures can ensure that requests are handled efficiently and correctly. 4. [**Maintain Records**:](https://dataprotectionpeople.com/white-paper/how-to-respond-to-a-data-subject-access-request-dsar/)Keeping detailed records of all DSARs and the actions taken can help in demonstrating compliance during audits. 5. [**Communicate Clearly**](https://blog.didomi.io/data-subject-access-request-dsar-the-complete-guide): Clear communication with the data subject throughout the process is crucial. Inform them of the steps being taken and any potential delays. The European Data Protection Board published in 2023 [Guidelines for Data Subject Access Requests](https://www.edpb.europa.eu/news/news/2023/edpb-adopts-final-version-guidelines-data-subject-rights-right-access_en). The Guidelines provide clarifications on the scope of the right of access, the information the controller has to provide to the data subject, the format of the access request, the main modalities for providing access, and the notion of manifestly unfounded or excessive requests. #### Penalties for Non-Compliance Non-compliance with DSAR requirements can lead to significant fines and penalties. Under the GDPR, organizations can be fined up to 4% of their annual global turnover or €20 million, whichever is higher, for serious infringements. Even minor breaches can result in fines of up to 2% of annual turnover or €10 million.  Currently  overall fines folowing breaches to GDPR has surpassed € 4.6bn and continuously increasing.  Check out the [GDPR enforcement tracker](https://www.enforcementtracker.com/) for more statitics. #### Conclusion Handling DSARs efficiently and effectively is not just a legal requirement but also a crucial aspect of maintaining trust with customers. By following best practices and staying informed about the latest regulations, organizations can avoid hefty fines and protect their reputation. EYD Subject Access Request Service provides your business the functionality needed to securely manage Subject Access Request and avoid fines.    [Learn more](https://eyd.tech/subjectaccessrequest?hsLang=en)    Check out some Real-World Examples Here are 15 notable breaches of Data Subject Access Requests (DSARs) along with references: | ![British Airways](https://www.bing.com/th?id=OSK.HEROJaAWnLzihDzE7vYhQ1nNjnUxSqCNcnL9LyOOq2R4ED0&pid=cdx&w=200&h=118&c=7) | **British Airways**: Fined £20 million for failing to protect customer data, including mishandling DSARs by not providing timely and complete responses.  [Read more](https://www.bbc.com/news/technology-54568784) | | --- | --- | | ![H&M](https://www.bing.com/th?id=OSK.HEROlf6cZnz5Xnq2ndRLwuqIcmYajhCcSRoVmIdea-RIPcY&pid=cdx&w=200&h=118&c=7) | **H&M:** Fined €35.3 million for illegally monitoring employees and mishandling DSARs by collecting excessive personal data without proper consent. [Read more](https://www.orrick.com/en/Insights/2020/10/Have-EU-Employees-Beware-HampM-Slapped-with-Massive-GDPR-Fine-for-Wrongful-Processing-of-Employee-D) | | ![Marriott International](https://www.bing.com/th?id=OSK.HERO4hZFFW03dHjKL2nn1cWQ7Fm5Z7nCrgneoFFHY6OF1dw&pid=cdx&w=200&h=128&c=7&rs=1) | [**Marriott International**:](https://www.bbc.co.uk/news/technology-54748843) Fined £18.4 million for a data breach that included failing to respond adequately to DSARs, affecting up to 339 million guests. [Read more](https://www.bbc.co.uk/news/technology-54748843) | | ![Equifax](https://www.bing.com/th?id=OSK.HERO27OMvIqyR_rDjWAwmdOQ5mb-8EnS7x3lnR_0C3qGa1M&pid=cdx&w=200&h=128&c=7&rs=1) | [**Equifax**:](https://www.ftc.gov/enforcement/refunds/equifax-data-breach-settlement?li_fat_id=686ec8fa-fba7-48d2-9b8d-0365a36657ea) Fined £500,000 for failing to protect personal data and mishandling DSARs by not providing requested information within the legal timeframe. [Read more](https://www.ftc.gov/enforcement/refunds/equifax-data-breach-settlement?li_fat_id=686ec8fa-fba7-48d2-9b8d-0365a36657ea) | | ![Google](https://www.bing.com/th?id=OSK.HERO7xHJevCZAib0wfKbpyk1RpeQaZR5RMei9bNwZ81z9qw&pid=cdx&w=200&h=128&c=7&rs=1) | [**Google**:](https://support.google.com/transparencyreport/answer/9713961?hl=en) Fined €50 million by the French data protection authority for lack of transparency and mishandling DSARs by not providing clear information on data processing [Read more](https://support.google.com/transparencyreport/answer/9713961?hl=en) | | ![Cathay Pacific](https://www.bing.com/th?id=OSK.HEROPu1kDmOdwBjrC28TzTEB5gE-E9FF6NcOD2V5DmCgE6Q&pid=cdx&w=200&h=128&c=7&rs=1) | [**Cathay Pacific**:](https://www.cathaypacific.com/cx/en_US/prepare-trip/flight-delays-and-cancellations.html) Fined £500,000 for failing to protect customer data and mishandling DSARs by not responding adequately to access requests [Read more](https://www.cathaypacific.com/cx/en_US/prepare-trip/flight-delays-and-cancellations.html) | | ![Uber](https://www.bing.com/th?id=OSK.HEROl6df5f_akyXT3gRo4jM-PUHUOErGwzcLPl0gdPY8clc&pid=cdx&w=200&h=128&c=7&rs=1) | [**Uber**:](https://www.autoriteitpersoonsgegevens.nl/en/current/uber-fined-eu10-million-for-infringement-of-privacy-regulations) Fined €10 million for making it unnecessarily complicated for drivers to submit DSARs and not providing clear information on data retention. [Read more](https://www.autoriteitpersoonsgegevens.nl/en/current/uber-fined-eu10-million-for-infringement-of-privacy-regulations) | | ![Facebook](https://www.bing.com/th?id=OSK.HEROeyKcRup7tXEOiWs3u9a7limsddCCo473LgW-7wcDr-U&pid=cdx&w=200&h=118&c=7) | [**Facebook**:](https://www.hollyland.com/blog/tips/facebook-says-i-violated-community-standards) Fined £500,000 for data breaches that included mishandling DSARs by not providing timely and complete responses. [Read more](https://www.hollyland.com/blog/tips/facebook-says-i-violated-community-standards) | | ![Ticketmaster](https://www.bing.com/th?id=OSK.HEROr5huxk09G_8pMcoh7aMwXil4Z7J08o8XD5CXsQptTXE&pid=cdx&w=200&h=128&c=7&rs=1) | [**Ticketmaster**:](https://help.ticketmaster.com/hc/en-us/articles/26110487861137-Ticketmaster-Data-Security-Incident) Fined £1.25 million for failing to protect customer data and mishandling DSARs by not responding adequately to access requests. [Read more](https://help.ticketmaster.com/hc/en-us/articles/26110487861137-Ticketmaster-Data-Security-Incident) | | ![BT Group](https://www.bing.com/th?id=OSK.HEROmzQiLQkFyN7eeeez996-SITNFN-iV-eVAKIqrS2yZt4&pid=cdx&w=200&h=128&c=7&rs=1) | [**British Telecom (BT)**:](https://www.bt.com/privacy-policy/) Fined £385,000 for failing to protect customer data and mishandling DSARs by not providing requested information within the legal timeframe. [Read more](https://www.bt.com/privacy-policy/) | | ![Yahoo!](https://www.bing.com/th?id=OSK.HERO1g5YRKiLjBl4Fldx_rgacSYSMFXNABFT7KcHIXV7U5A&pid=cdx&w=200&h=128&c=7&rs=1) | [**Yahoo**:](https://www.orrick.com/en/Insights/2020/10/Have-EU-Employees-Beware-HampM-Slapped-with-Massive-GDPR-Fine-for-Wrongful-Processing-of-Employee-D) Fined £250,000 for failing to protect customer data and mishandling DSARs by not providing timely and complete responses. [Read more](https://www.orrick.com/en/Insights/2020/10/Have-EU-Employees-Beware-HampM-Slapped-with-Massive-GDPR-Fine-for-Wrongful-Processing-of-Employee-D) | | ![Wind Tre](https://www.bing.com/th?id=OSK.55438f0f3f7d858f453f69066dacb144&pid=cdx&w=200&h=128&c=7&rs=1) | [**Wind Tre**:](https://www.orrick.com/en/Insights/2020/10/Have-EU-Employees-Beware-HampM-Slapped-with-Massive-GDPR-Fine-for-Wrongful-Processing-of-Employee-D) Fined €16.7 million for mishandling customer data and DSARs by not providing clear information on data processing. [Read more](https://www.orrick.com/en/Insights/2020/10/Have-EU-Employees-Beware-HampM-Slapped-with-Massive-GDPR-Fine-for-Wrongful-Processing-of-Employee-D) | |   | [**Dixons Carphone**:](https://www.orrick.com/en/Insights/2020/10/Have-EU-Employees-Beware-HampM-Slapped-with-Massive-GDPR-Fine-for-Wrongful-Processing-of-Employee-D) Fined £500,000 for failing to protect customer data and mishandling DSARs by not responding adequately to access requests.  [Read more](https://www.orrick.com/en/Insights/2020/10/Have-EU-Employees-Beware-HampM-Slapped-with-Massive-GDPR-Fine-for-Wrongful-Processing-of-Employee-D) | | | [**Telecom Italia**:](https://www.orrick.com/en/Insights/2020/10/Have-EU-Employees-Beware-HampM-Slapped-with-Massive-GDPR-Fine-for-Wrongful-Processing-of-Employee-D) Fined €27.8 million for mishandling customer data and DSARs by not providing clear information on data processing.  [Read more](https://www.orrick.com/en/Insights/2020/10/Have-EU-Employees-Beware-HampM-Slapped-with-Massive-GDPR-Fine-for-Wrongful-Processing-of-Employee-D) | |   | [**Eni Gas e Luce**:](https://www.orrick.com/en/Insights/2020/10/Have-EU-Employees-Beware-HampM-Slapped-with-Massive-GDPR-Fine-for-Wrongful-Processing-of-Employee-D) Fined €11.5 million for mishandling customer data and DSARs by not providing clear information on data processing. [Read more](https://www.orrick.com/en/Insights/2020/10/Have-EU-Employees-Beware-HampM-Slapped-with-Massive-GDPR-Fine-for-Wrongful-Processing-of-Employee-D) | These cases highlight the importance of properly handling DSARs to avoid significant fines and maintain customer trust.   Share: [facebook-f icon](http://www.facebook.com/share.php?u=https://eyd.tech/en/news-updates/understanding-subject-access-requests-dsar-best-practices-and-penalties) [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://eyd.tech/en/news-updates/understanding-subject-access-requests-dsar-best-practices-and-penalties) [twitter icon](https://twitter.com/intent/tweet?url=https://eyd.tech/en/news-updates/understanding-subject-access-requests-dsar-best-practices-and-penalties) [pinterest-p icon](http://pinterest.com/pin/create/link/?url=https://eyd.tech/en/news-updates/understanding-subject-access-requests-dsar-best-practices-and-penalties) [envelope icon](mailto:?body=https://eyd.tech/en/news-updates/understanding-subject-access-requests-dsar-best-practices-and-penalties) ## Related posts [![](https://eyd.tech/hubfs/Blog%20postings/GDPR%20Fine%20Subject%20Data%20Access%20Request-1.png)](https://eyd.tech/en/news-updates/compensation-to-a-data-subject-for-faling-to-respond-to-a-subject-data-access-request?hsLang=en) [Subject Access Requests](https://eyd.tech/en/news-updates/tag/subject-access-requests) ### [Compensation to a Data subject](https://eyd.tech/en/news-updates/compensation-to-a-data-subject-for-faling-to-respond-to-a-subject-data-access-request?hsLang=en) [![](https://eyd.tech/hubfs/GDPR%20Fine%20Subject%20Data%20Access%20Request.png)](https://eyd.tech/en/news-updates/fines-on-data-subject-access-request-increase-as-untold-srl-is-fined-15000-for-its-violation?hsLang=en) [Privacy](https://eyd.tech/en/news-updates/tag/privacy) ### [Fines on Data Subject Access Request increase](https://eyd.tech/en/news-updates/fines-on-data-subject-access-request-increase-as-untold-srl-is-fined-15000-for-its-violation?hsLang=en) [![](https://eyd.tech/hubfs/my%20data%20award%202025-1.png)](https://eyd.tech/en/news-updates/eyd-tildelt-prisen-mydata-award-for-technology-2025?hsLang=en) [News](https://eyd.tech/en/news-updates/tag/news) ### [EYD acknolwedged with the MyData Award 2025!](https://eyd.tech/en/news-updates/eyd-tildelt-prisen-mydata-award-for-technology-2025?hsLang=en) [![logo_white_480](https://eyd.tech/hs-fs/hubfs/logo_white_480.png?width=70&height=57&name=logo_white_480.png "logo_white_480")](https://eyd.tech/no/?hsLang=en) Privacy made simple. [facebook-f icon](https://www.facebook.com/eyd) [linkedin-in icon](https://www.linkedin.com/company/eyd-company/) [instagram icon](https://www.instagram.com/eyd_tech/) **Insight**   [Privacy Policy](https://eyd.tech/no/personvernerkl%C3%A6ring?hsLang=en) [Privacy Policy EYD's Services](https://eyd.tech/no/personvernerkl%C3%A6ring-eyd?hsLang=en) [Data Processor Agreement](https://eyd.tech/no/databehandleravtale?hsLang=en) [Terms and Conditions](https://eyd.tech/no/vilkar?hsLang=en) [Home](https://eyd.tech/home?hsLang=en)   [The team](https://eyd.tech/no/om-oss?hsLang=en) [The board](https://eyd.tech/no/styret?hsLang=en) [FAQ](https://eyd.tech/no/faq?hsLang=en)   [Get in touch](https://eyd.tech/getintouchwithus?hsLang=en) [hello@eyd.tech](mailto:hello@eyd.tech) Jonsvannsveien 140 7050 Trondheim Norway © 2023 EYD AS ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "EYD privacy", "url" : "https://eyd.tech/en/news-updates/author/eyd-privacy" }, "dateModified" : "2025-03-10T10:41:15.348Z", "datePublished" : "2024-08-01T05:29:26.000Z", "headline" : "Understanding Subject Access Requests (DSAR): Best Practices and Penalties", "image" : [ "https://eyd.tech/hubfs/AdobeStock_856935814_linkedin.png" ], "mainEntityOfPage" : { "@id" : "https://eyd.tech/en/news-updates/understanding-subject-access-requests-dsar-best-practices-and-penalties", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://eyd.tech/hubfs/logo_white_480.png" }, "name" : "EYD" } } ``` ```json { "@context" : "http://schema.org", "@type" : "Article", "author" : { "@type" : "Person", "name" : [ "EYD privacy" ], "url" : "https://eyd.tech/en/news-updates/author/eyd-privacy" }, "datePublished" : "2024-08-01T05:29:26+0000", "description" : "Understanding Subject Access Requests (DSAR): Best Practices and Penalties.", "headline" : "Understanding Subject Access Requests (DSAR): Best Practices and Penalties", "image" : "https://eyd.tech/hubfs/AdobeStock_856935814_linkedin.png", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://eyd.tech/hubfs/logo_white_480.png" }, "name" : "EYD" }, "url" : "https://eyd.tech/en/news-updates/understanding-subject-access-requests-dsar-best-practices-and-penalties" } ```