Osman Husain
A Data Subject Access Request (DSAR) is a person's request to a business or other organization for a copy of the personal data it holds about them and how it is used. DSARs are a core part of complying with privacy laws like the GDPR and CCPA. In the UK, a DSAR is usually called a subject access request, or SAR.
The GDPR and CCPA protect this right, as do Brazil's LGPD, South Korea's PIPA, and U.S. states such as Colorado, Connecticut, and Virginia. Each has its own rules on how quickly you must respond, but the principle is the same: people need an easy, accessible way to request a copy of their data and to see how businesses use it.
What is a DSAR?
A DSAR asks an organization two things: whether it processes the person's data, and if so, for access to it. The person also gets the details around that data, such as why it's used and who receives it.
People make DSARs for all kinds of reasons, and they don't have to tell you why. The right exists so people can check that their data is handled lawfully. The first copy is always free, even when the person wants it for a legal dispute, as the EU's top court confirmed in FT (C-307/22).
What is a data subject?
A data subject is the person the data is about. That could be a customer, an employee or someone who visited your website.
The organization that decides how the data is used, and has to answer the DSAR, is the controller. Vendors that handle data for you, like a payroll or email provider, are processors.
What can a person get with a DSAR?
Someone who makes a DSAR gets a copy of their data, plus the context around it. Europe's rules ask for more of that context than California's.
| What the person receives | EU GDPR | California CCPA |
|---|---|---|
| A copy of the data | A copy of the personal data undergoing processing, under Art. 15(3) | The specific pieces of personal information collected, under § 1798.110(a)(5) |
| Why the data is used | The purposes of the processing, under Art. 15(1)(a) | The business or commercial purpose for collecting, selling or sharing it, under § 1798.110(a)(3) |
| What kinds of data | The categories of personal data, under Art. 15(1)(b) | The categories of personal information collected, under § 1798.110(a)(1) |
| Who received it | Recipients or categories of recipient, especially outside the EU, under Art. 15(1)(c) | Categories of third parties it was disclosed to, under § 1798.110(a)(4), and categories sold or shared, under § 7024(k)(5) |
| Where it came from | Any available information on the source, if not collected from the person, under Art. 15(1)(g) | The categories of sources, under § 1798.110(a)(2) |
| How long it is kept | The storage period, or the criteria for setting it, under Art. 15(1)(d) | Not in the § 1798.110 list |
| Other rights | The rights to rectification, erasure, restriction and objection, and to complain to a regulator, under Art. 15(1)(e), (f) | Not in the § 1798.110 list |
| Automated decisions | Whether automated decision-making, including profiling, is used, with meaningful information about the logic and consequences, under Art. 15(1)(h) | A separate request to access automated decisionmaking technology, under § 7021 |
| Transfers abroad | The safeguards for transfers outside the EU, under Art. 15(2) | Not in the § 1798.110 list |
Requesting a DSAR
A person can ask for a DSAR in their own words. All it needs is a clear ask to see the personal data you hold about them.
The GDPR expects you to make this easy. In practice, that means one clear way to ask, such as a form or a privacy email address, plus staff who know to pass on requests that arrive any other way. A simple process also makes your deadline easier to hit.
Rules on format differ by country. In the UK, someone can make a request verbally or on social media. In Canada, PIPEDA requires written requests.
DSAR vs DSR vs SAR: what's the difference?
A data subject request (DSR) is any request someone makes to use a privacy right. A DSAR is the access request, the one that asks for a copy of the data. SAR is simply the UK name for a DSAR. Other DSRs ask you to do something with the data, like delete or correct it.
Types of data subject requests
Each law uses its own names for these requests. A request to remove data is an "erasure" request under the GDPR and a "request to delete" under the CCPA.
| Term | What it covers | Where the term is used |
|---|---|---|
| Data subject access request (DSAR) | Confirmation that data is processed, a copy of it and details about its use | Common name for the right in GDPR Article 15, also used by UK regulators |
| Subject access request (SAR) | The same access right | UK GDPR and the Information Commission's SAR guidance |
| Request to know | Access to categories and specific pieces of personal information | California, under § 1798.110 |
| Data subject request (DSR) | Any privacy right, including the request types below | Umbrella term for the GDPR rights in Articles 15 to 22 |
| Deletion or erasure request | Removing personal data | GDPR erasure right, listed in Art. 15(1)(e); California request to delete, under § 7021; Brazil's art. 18 |
| Correction or rectification request | Fixing inaccurate or incomplete data | GDPR rectification right; California request to correct, under § 7021; Quebec's section 32; Brazil's art. 18 |
| Objection or opt-out request | Stopping some uses of the data | GDPR objection right, listed in Art. 15(1)(e); revoking consent under Brazil's art. 18 |
| Portability request | A copy in a structured, commonly used format | Quebec's section 27; Brazil's art. 18 |
Which laws give people the right to make a DSAR?
The right of access appears in most modern privacy laws. This guide covers the ones businesses run into most: the EU GDPR, the UK GDPR, California's CCPA and other US state laws, Canada's PIPEDA, Quebec's Law 25 and Brazil's LGPD.
The EU GDPR right of access (Article 15)
The EU's General Data Protection Regulation has given people a right of access since 25 May 2018. Article 15 sets out what people get. Article 12 covers how and when you must respond.
The EDPB, the board of EU data protection regulators, has published detailed guidelines on how it reads both articles. They were last updated in May 2024.
UK GDPR and the Data (Use and Access) Act 2025
In the UK, the right of access comes from the UK GDPR. The Data (Use and Access) Act 2025, which became law on 19 June 2025, changed how it works in four ways:
- Searches: you only have to find what a reasonable and proportionate search turns up. The rule applies to requests from 1 January 2024.
- The clock: since 5 February 2026, the month starts from whichever comes last: the request, the ID you asked for, or the fee.
- Complaints: since 19 June 2026, people can complain to you directly. You have to acknowledge each complaint within 30 days.
- The regulator: on 30 September 2026, the Information Commission took over from the Information Commissioner. Most people still call it the ICO.
California's CCPA and other US state laws
California's CCPA calls this the right to know. It lets someone see the personal information a business has collected about them. Since 1 January 2023, it has also covered employees, job applicants and business contacts.
Your answer normally covers the past 12 months. If the person asks, you go further back, as far as 1 January 2022.
Most other US states with privacy laws give people a similar right, with a 45-day deadline. Virginia's law has applied since 2023, and Rhode Island's since 2026. Oklahoma, Louisiana, Alabama and Vermont have laws taking effect in 2027 or 2028. Our guide to state privacy laws covers each one.
Canada: PIPEDA and Quebec Law 25
Canada's federal privacy law, PIPEDA, gives people their information plus an account of how it was used and who it was shared with. If someone asks for help writing their request, you must help them.
In Quebec, requests go to the person in charge of protecting personal information at your organization.
Brazil: the LGPD right of access
Brazil's LGPD lets people ask, at any time, whether businesses process their data and how to access it.
DSAR deadlines: how long a business has to respond
Most privacy laws give you between two weeks and three months to answer a DSAR. Brazil is the strictest, at 15 days for a full answer. Iowa is the most relaxed, at 90 days. The GDPR gives you one calendar month.
| Law | Deadline | When the clock starts | Extension | Fee rule |
|---|---|---|---|---|
| EU GDPR | One calendar month, under Art. 12(3) | When the request reaches an official channel, per EDPB guidance | Up to two further months for complex or numerous requests, with notice and reasons in the first month | Free; a reasonable fee only for further copies or manifestly unfounded or excessive requests |
| UK GDPR | One calendar month, under Article 12A | The latest of receipt, receipt of requested ID or payment of a permitted fee | Two further months for complex or numerous requests, with notice and reasons in the first month | Free in most cases; a fee for further copies or manifestly unfounded or excessive requests |
| California CCPA | 45 calendar days, under § 7021(b) | Receipt, regardless of how long verification takes | Once, by 45 days, with notice in the first 45 days | Free, under § 1798.130; no duty to answer more than two requests to know in 12 months |
| Most other US state laws: Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, New Hampshire, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island | 45 days | Receipt | 45 more days, with notice and a reason in the first 45 days | One free response per 12 months in 10 of these states, and at least two in the other 6 |
| Iowa | 90 days, under § 715D.3 | Receipt | Once, by 45 days | Free up to twice a year |
| Florida (controllers with over $1 billion in global revenue, among other conditions) | 45 days, under § 501.706 | Receipt | Once, by 15 days | Free at least twice a year |
| Canada, PIPEDA | 30 days, under s. 8(3) | Receipt | Up to 30 more days on two grounds; longer to convert to an alternative format | Minimal or no cost; a charge only after stating the approximate cost |
| Quebec, Law 25 | 30 days, under s. 32 | Receipt | None in the statute | Free; a reasonable charge for transcription, reproduction or transmission |
| Brazil, LGPD | Immediately in simplified form, or 15 days for a complete declaration, under art. 19 | The date of the request | None in the statute; small businesses get double time for the complete declaration | Free, under art. 18 |
When does the DSAR clock start?
The clock starts the day the request arrives. A request that sits unread in a general inbox for a week has already used a week of your time.
Under the GDPR, a request that arrives on 5th March is due on 5th April. When the next month is shorter, the deadline is its last day, so 31 August becomes 30 September. A deadline that lands on a weekend or public holiday moves to the next working day.
Can a business extend the DSAR deadline?
Sometimes. The GDPR lets you add up to two more months for a complex request, or when one person sends several, as long as you tell them why within the first month.
In the UK, an extension gives you up to three months from the original start date. The UK regulator also says your organization's size and resources count when it decides whether a request is complex.
In Canada, PIPEDA allows 30 extra days only if meeting the deadline would unreasonably interfere with your operations, or if you need to consult others first.
Who can submit a DSAR?
Anyone whose data you hold can make a DSAR: customers, employees, former employees, job applicants and business contacts. Someone can also ask on their behalf, like an authorized agent, a parent or a lawyer.
DSARs made on someone else's behalf
A request made for someone else is valid when the sender can show they have the authority. In California, that includes an authorized agent, a parent of a minor child, and someone with power of attorney or a conservatorship.
For California requests, you can ask an agent for signed permission and ask the person to confirm their own identity. You can't insist on a power of attorney. You also can't charge for verification.
In the UK, the deadline starts once you receive the proof of authority you asked for. A bulk request from a claims firm counts the same as one from the person. Brazil's LGPD also accepts requests made through a legal representative.
DSARs from past and current employees
Employees and former employees can make DSARs too. In the EU, someone who was fired and wants their file for an unfair-dismissal claim still gets access. Performance reviews, disciplinary records and promotion notes all count as personal data.
In California, employees and job applicants have CCPA rights as well.
What a DSAR form should include
A good DSAR form asks only for what you need to identify the person, understand the request and reply. EU regulators warn against asking for more personal data than the identity check requires.
DSAR form fields
Typically, a DSAR covers six fields:
- Request type, such as access, deletion, correction or opt-out, so you can route the request.
- Name and email address, so you can match records and reply.
- Country and, in the US, state, so you know which law and deadline apply.
- Requester role, consumer or authorized agent, with an upload for an agent's proof.
- Date range or all data, which California requires if you keep data longer than 12 months, so people can ask for older data.
- Optional details, to help you find the data.
How to respond to a DSAR, step by step
Responding to a DSAR comes down to seven steps: log and acknowledge, verify identity, clarify scope, find the data, review and redact, deliver securely, and keep a record.
Step 1: Log and acknowledge the DSAR
Log every request the day it arrives, because that date sets your deadline. Then send a quick written confirmation with the due date, which EU regulators recommend.
In California, you have to send that confirmation within 10 business days and explain how you'll verify the request and when to expect an answer. An acknowledgment on its own doesn't count as your response.
Step 2: Verify the requester's identity
Under the GDPR, you can ask for more information only if you have reasonable doubt about who the person is. If they're already logged in to their account, that's usually enough. You can refuse on identity grounds only if you can show you can't identify them.
In California, businesses need a documented verification method. A request about categories of data needs a reasonable degree of certainty, such as two matching data points.
Step 3: Clarify the scope
If you hold a lot of data about someone, you can ask them which information or activities their request covers. In the EU, regulators allow the clock to pause while you wait for their answer.
In the UK, a clarifying question pauses the clock, and it restarts the day after they reply. A request received on 14 May, clarified on 15 May and answered on 18 May is due on 18 June.
Step 4: Find the data across systems and vendors
Search every place that holds the person's data: email, archives, backups and your vendors' systems. Backups count too. A current data map, listing each system and vendor, turns this step into a checklist.
In the UK, your search has to be reasonable and proportionate. EU regulators set no such effort limit.
Step 5: Review and redact
Review every record before you send it. Take out anything the person isn't entitled to see, such as other people's data or exempt material. Keep redactions targeted, because protecting other people is never a reason to withhold everything.
Some data should never be shared, period. In California, you can't disclose Social Security numbers, government ID numbers, financial account numbers, passwords or biometric data. Instead, simply confirm that you hold that information but keep it anonymized.
Step 6: Deliver the response securely
Send the response securely, in a format the person can use. If the submission was made electronically, the response should be in a common electronic format unless they ask for something else.
California lets you use a secure self-service portal for account holders. In Brazil, the person can choose electronic or printed delivery. The UK regulator advises against replying over social media.
Your response includes the data plus the context around it, such as why you use it, who receives it and how long you keep it.
Step 7: Keep a record
Keep a record of every DSAR so you can show a regulator what you did and when. California requires you to keep records of requests and responses for at least 24 months. A ticket or log entry is enough if it captures the date, request type, channel, your response and any reason for refusing.
Keep the record about the request itself. The GDPR says you shouldn't keep personal data just to answer future requests.
DSAR templates
These templates give you consistent wording for the letters most requests need. Fill in the bracketed details and adjust each one for the applicable law.
DSAR acknowledgment template
Send this as soon as a request arrives. It confirms receipt, the due date and any identity check.
Subject: We have received your data request [reference number] Dear [name], We received your request for a copy of your personal data on [date received]. We will respond by [due date]. [GDPR or UK GDPR:] The one-month response period runs from [date received] to [due date]. Before we release any data, we need to confirm your identity. [Describe the check.] We will use the information you give us only to verify this request. If you have questions, please contact [name of contact person] at [email address or phone number]. Kind regards, [Name, role, organization]
DSAR response letter template
Use this when you send the data. Bracketed notes mark lines that only apply in some cases or under some laws.
Subject: Response to your data request [reference number] Dear [name], We have completed your request of [date received]. [If data is held:] A copy of your personal data is attached as [file name and format]. [If no data is held:] We do not hold any personal data about you. About the data we hold: - Why we use it: [purposes of processing] - Types of data: [categories of personal data] - Who receives it: [recipients or categories of recipient, including any outside the EU or UK, and the safeguards for those transfers] - How long we keep it: [retention period, or the criteria used to set it] - Where it came from: [source, if not collected from you] - Automated decisions: [whether we make automated decisions about you, including profiling, the logic involved and the likely consequences] You can ask us to correct or erase your data, to restrict how we use it, or object to our use of it. You can complain to [name of supervisory authority]. [UK GDPR only:] You can also make a complaint to us at [complaints contact]. [If anything is withheld:] We have not included [type of information] because [reason and legal basis]. If you have questions, please contact [name] at [email address]. Kind regards, [Name, role, organization]
DSAR extension notice template
Send this if you need more time to respond.
Subject: Update on your data request [reference number] Dear [name], We received your request on [date received]. We need more time to respond because [reason, for example: the request is complex, or we have received several requests from you]. We will now respond by [new due date]. [PIPEDA only:] You have the right to make a complaint to the Privacy Commissioner of Canada about this extension. If you have questions, please contact [name] at [email address]. Kind regards, [Name, role, organization]
DSAR refusal letter template
Use this when you can't act on all or part of a request. It explains why and tells the person how to challenge your decision. Under the GDPR, send it within one month of receiving the request.
Subject: Your data request [reference number] Dear [name], We received your request on [date received]. We are unable to [act on your request / provide part of the information you asked for]. Reason: [the reason, the facts behind it and the legal provision relied on]. Your options: - You can complain to [name and contact details of the supervisory authority]. - You can seek a remedy through the courts. - [UK GDPR only:] You can also make a complaint to us at [complaints contact]. - [PIPEDA only:] You can complain to the Privacy Commissioner of Canada. - [Quebec only:] You can apply to the Commission d'accès à l'information within 30 days of this decision. - [US state law with an appeal process:] You can appeal this decision by [appeal instructions and deadline]. If you have questions, please contact [name] at [email address]. Kind regards, [Name, role, organization]
DSAR request template for individuals
This one is for people making a request. Share it with customers who ask how to request their data.
Subject: Data subject access request Dear [organization name], I am making a data subject access request under [the GDPR / the UK GDPR / the CCPA / the law that applies]. Please confirm whether you process personal data about me. If you do, please send me a copy of that data and the information the law entitles me to, such as why you use it, who you share it with and how long you keep it. To help you find my data, here are my details: [full name, email address, account or customer number, and any other identifying details, such as dates of contact]. Please send your response to [email address or postal address]. Thank you, [Name of the person making the request] [Date]
Can a business refuse a DSAR or charge a fee?
Typically, businesses cannot refuse to respond to a data access request. The only exception is when the request is excessive, but the burden of proof lies with the organization. Responding to a DSAR should also be free of charge.
Excessive data requests
Repeated requests for the same data are an example of an excessive request, one that businesses can use. However, regulators won't always side with the business on this one, which makes it necessary to store records and logs of each subject request.
In March 2026, the EU's top court ruled in Brillen Rottler that even a first request can be excessive, if you can prove the person has abusive intent.
What must a DSAR refusal include?
If you refuse a request under the GDPR, you must explain why within one month. The data subject must be kept informed of their rights i.e. they can complain to a regulator and take businesses to court.
Other laws add their own requirements. PIPEDA needs a written refusal with your reasons and any options to challenge it. Quebec adds the legal provision you relied on and the deadline for a remedy. California requires your reasons and any appeal rights. Most other US states require an appeal process, usually decided within 60 days, as in Virginia.
Does a business have to hand over all the data it holds?
A DSAR covers the person's own personal data. You can hold back other people's information and anything the law exempts.
A DSAR covers the person's own data
A DSAR gets the person a copy of their own personal data. Under the GDPR, that's a copy of the data you process about them. In California, it's the specific pieces of information you've collected. Indiana lets you send a representative summary of the data the person gave you.
Information about other people in a DSAR response
Other people's information deserves protection, but it rarely justifies holding back a whole record. Under the GDPR, the copy you send can't harm anyone else's rights.
In the UK, you don't have to disclose information that identifies someone else, unless they agree or it's reasonable to share it. Canada is stricter. Under PIPEDA, you must not reveal a third party's information, and you must redact it where you can.
Legal exemptions from a DSAR
Some material can be held back by law. In the UK, Schedule 2 of the Data Protection Act 2018 lists the exemptions, including:
- Legal privilege: material covered by legal professional privilege.
- Management forecasts: planning data, if disclosing it would likely prejudice your business.
- Negotiation records: your intentions in negotiations with the person, if disclosing them would likely prejudice those negotiations.
- Confidential references: references given in confidence for someone's education, training, employment, volunteering, office or services.
- Crime and tax: data used to prevent or detect crime or to collect tax, if disclosing it would likely prejudice that work.
PIPEDA has its own closed list, including solicitor-client privilege and confidential commercial information.
Data held by vendors and processors
Data your vendors hold for you is still part of the DSAR. The UK regulator says using a processor doesn't make a request complex.
Your response should name who received the data, or at least the types of recipients. In California, that includes the categories of service providers and contractors. For more on retail requests, see our guide to ecommerce DSARs.
Who handles DSARs inside a company
DSARs have one central point of contact, usually your privacy lead or legal counsel, backed by a small team that knows where your data is kept.
Build a DSAR response team
Most teams cover four roles:
- Owner: logs each request, tracks the deadline and signs off on the response.
- Data lead: knows which systems and vendors hold personal data.
- Support lead: handles contact with the requester, including identity checks.
- HR contact: handles employee and former employee requests.
Bring in legal counsel for refusals, exemptions and redactions.
Write a DSAR playbook
A playbook turns DSAR handling into a routine that doesn't depend on one person's memory. Write down:
- every channel where requests can arrive, and who watches each one;
- the identity check for each request type, which California requires as a documented method;
- the systems and vendors to search, taken from your data map;
- the deadline rules for each law that applies to you;
- your approved templates, and when to bring in legal counsel.
Train front-line staff to spot DSARs
Requests often arrive outside your form. In the UK, someone can ask any employee, by phone, in person or on social media, without using any special wording. Train support, sales and social media staff to log any message asking for a person's own data and pass it to the DSAR owner the same day.
Run a test DSAR
Send a test request through each channel you publish. You'll see whether it reaches the owner and how long each search takes. Run one every quarter, and again after you add a new tool. It's the easiest way to catch a broken form or an unwatched inbox before a real requester does.
Ignoring data access requests
Ignoring a DSAR can lead to fines, enforcement action and compensation claims. In Canada, missing the deadline counts as a refusal, which opens the door to a complaint. Quebec treats silence the same way. Brazil's LGPD allows fines of up to 2% of revenue in Brazil, capped at BRL 50 million per infraction.
GDPR and UK GDPR fines
GDPR fines for breaching someone's data rights can reach EUR 20 million or 4% of worldwide annual turnover, whichever is higher. In the UK, the maximum is GBP 17.5 million or 4%. These are maximums. The actual fine depends on the circumstances.
Compensation is a separate risk. In March 2026, the EU's top court ruled that an unanswered access request can support a compensation claim, including for loss of control over data, as long as the person suffered harm. In the UK, destroying or hiding information to prevent disclosure is a criminal offence.
California's CCPA penalties
CCPA penalties are up to $2,663 per violation, or $7,988 if the violation involved consumers under 16. These amounts have applied since January 2025 and cover both agency fines and Attorney General penalties.
Regulator decisions about DSARs
In July 2024, Lithuania's data protection authority fined Vinted EUR 2,385,276 after complaints about how it handled access and erasure requests. Vinted couldn't show it had acted on, or refused, one user's access request.
In August 2024, the UK regulator reprimanded the Labour Party. Of 352 subject access requests received by November 2022, 78% missed the three-month maximum and 56% were more than a year late. About 646 more sat in a privacy inbox that nobody monitored.
How Enzuzo handles DSARs
Enzuzo's DSAR software starts with a form that asks for the request type, name, email, country and, for US residents, the state, with an optional comment. When identity verification is switched on, Enzuzo emails the requester a "Verify Identity" link that expires after 48 hours. The request waits until they confirm.
Each request shows the days left under the law it's tagged with, counted from the requester's email confirmation. Requests move through statuses such as Action Required, Collecting, Deleting and Complete. Each request keeps an activity log.
For Shopify stores, Enzuzo can find the requester in Shopify and delete their customer record or unsubscribe them from email, SMS and WhatsApp marketing. For access requests, the requester receives their data as a file.
Frequently asked questions about DSARs
What does DSAR stand for?
DSAR stands for data subject access request. The name explains itself: a data subject, the person the data is about, asks for access to their own data. In the UK, DSAR, SAR and subject access request all mean the same thing. Our glossary has a short DSAR definition.
Does a person have to give a reason for a DSAR?
A person can make a DSAR without giving any reason. Focus on what they're asking for. They also don't have to say what they'll do with the information.
How is a DSAR different from a freedom of information (FOI) request?
A DSAR gets a person their own data from any organization. A freedom of information (FOI) request gets recorded information from a public authority.
Can a business ask for ID before answering a DSAR?
You can, if you have a reasonable doubt about who's asking and the check fits the risk. EU regulators say asking for a copy of ID from someone who's already logged in goes too far. In the UK, ask for formal ID documents only when you really need them.
How many times can a person make a DSAR?
Under the GDPR, people can make repeat requests at reasonable intervals, with no fixed yearly limit. A request a year later counts as a new request, with a new free copy. California caps your duty at two responses to requests to know in 12 months. Ten other US states require one free response per 12 months.
Does a DSAR cover emails and CCTV footage?
Emails and CCTV footage are covered when they contain the person's data, according to the UK regulator. In an email, you only have to disclose the person's own information. Moving an email to the deleted items folder doesn't delete it. For CCTV, provide the parts showing the person in a common video format.
Can a business ask a person to narrow their DSAR?
If you hold a lot of data about someone, you can ask them to narrow their request. You can't force them to. If they confirm they want everything, you have to provide it all.
Do small businesses have to answer DSARs?
Small businesses have to answer DSARs too. The GDPR and UK GDPR have no size exemption for access requests. The UK regulator tells small organizations that a SAR needs action. US state laws only apply above certain thresholds, such as California's $26,625,000 in annual gross revenue.
Osman Husain
Osman is the content lead at Enzuzo. He has a background in data privacy management via a two-year role at ExpressVPN and extensive freelance work with cybersecurity and blockchain companies. Osman also holds an MBA from the Toronto Metropolitan University.
LinkedIn →More related blogs
Your next read
%20Post%201.jpg)
