What is DSR (Data Subject Request)?
A data subject request (DSR) is a request by an individual to exercise rights over their personal data under privacy laws such as the GDPR. Common requests are access to a copy of the data, correction, erasure, restriction of processing and portability. Organisations must verify the requester, respond within legal deadlines and record how each request was handled.
How Personal Academy handles it
Personal Academy offers self-service export of a person’s own data and self-service erasure across every organisation they belong to, plus organisation export as CSV and JSON for administrators.
A worked example
Suppose a former contractor of a 300-person media company asks for a copy of everything held about them and then asks for it to be deleted. They sign in, download their own data export, and request erasure, confirming by typing their email address. The company records the request and checks that no legal hold applies, so the request is complete within the deadline.
The GDPR, which applies across the European Union and in a similar form in the United Kingdom, gives individuals several rights over their personal data. Other privacy laws around the world grant similar rights. Requests to exercise them are often called data subject requests or data subject access requests.
The right of access lets a person obtain confirmation that their data is processed and a copy of it, with information about purposes, recipients and retention. The right to rectification lets them correct inaccurate data. The right to erasure lets them ask for deletion where there is no longer a lawful reason to keep it. The right to data portability lets them receive data they provided in a structured, machine-readable format.
Under the GDPR, organisations must normally respond within one month, extendable in some cases. They must verify the requester identity without collecting excessive extra data, search every system that holds the person data, and keep a record of the response.
Erasure has limits. Data may be kept where another law requires it, for example records needed for legal claims or regulatory retention. A legal hold should pause deletion of relevant records, and the organisation should tell the person what was kept and why.
Learning platforms hold a surprising amount of personal data: profile details, course progress, assessment answers, certificates, discussion posts and audit entries. Self-service tools for access and erasure reduce the workload on administrators and shorten response times. Organisation-wide export supports portability when a customer leaves a vendor. Clear records of each request also help when a regulator asks how requests are handled.