DSARs Under GDPR: Can You Say No?

If you work in privacy, you’ve probably dealt with Data Subject Access Requests (DSARs)—and maybe even wished you could refuse a few. While access to personal data is a fundamental GDPR right, it’s not absolute.

So, when can you say no to a DSAR?

🚦 1. It’s manifestly unfounded or excessive:

If someone is spamming you with requests or using DSARs as a weapon (think ex-employees trying to make your life miserable), you can push back. But be careful—the burden is on you to prove it's excessive (checkout relevant case law from around Europe and your local SA's stance on the matter).

📂 2. The data no longer exists:

The simplest reason: you don’t have the data anymore because the retention period expired. This is why having a clear retention policy isn’t just good practice—it can also protect you from unnecessary DSAR headaches.

📊 3. It would take a ridiculous amount of effort:

If you’d have to dig through old backups, thousands of emails, or unstructured archives, you might have a case for refusing. But simply saying, “this is hard,” won’t cut it.

👥 4. It affects others’ rights:

If disclosing the data would expose trade secrets, intellectual property, or someone else’s personal data, you can (and should) redact or refuse parts of the request.

⚖️ 5. There’s an ongoing legal case:

If an investigation or legal dispute is underway, giving access might compromise the process. This is a common scenario in HR disputes, fraud cases, or compliance investigations.

🛠️ So, what’s the best approach?

✔️ Don’t ghost the requester—explain why you’re refusing.

✔️ If possible, offer partial access instead of outright saying no.

✔️ Document your reasoning. If the regulator comes knocking, you’ll want that record.

DSARs are tricky—sometimes they’re legitimate, and sometimes they feel like a weaponized nuisance.

We at Klarity can help you navigate difficult DSARs and help you create a process to make life easier for your company. Let us clarify your privacy challenges!