- Google CMP Gold
- 4.6/5 G2
- 4.5/5 SHOPIFY
DSAR Software for Data Subject Access Requests
Enzuzo collects data subject access requests through one form on the website or in the privacy policy, keeps every request in one dashboard, and shows how many days are left to answer each one.
Real Teams, Surreal Results
-
Rated on G2
4.6
/5 -
Google CMP Partner
Gold
-
Security Certified
SOC II
"Our goal was to give our clients' users a clear sense of consent, ownership and transparency over how their data is tracked, and take that onus off our clients. Mission accomplished."
-
“My entire experience with Enzuzo has been very positive. From the initial trial all the way through the purchase process. Everything has been great. 10 out of 10.”
Brian Zito MARKETING, YALE -
“Enzuzo is completely self-serve and easy to use, and very attractively priced relative to competitors.”
Emily Wilkinson Lucy Group
Collect data subject access requests with one form
Visitors pick a request type, fill in their details and review the request before they submit it. Every request lands in the Enzuzo dashboard.
-
Where it lives: inside the Enzuzo privacy policy, on a standalone page, or linked from the site footer.
-
Four request types: get a copy of personal data, delete personal data, do not sell or share, and unsubscribe from marketing.
-
Custom design: on Growth, Pro and Enterprise plans, edit the form's title, text and button colors, or add custom CSS.
Keep every DSAR in one dashboard
Not every request comes through the form. Requests that arrive by email, phone, support chat or mail can be added to the dashboard by hand, so each one is tracked the same way.
-
Any channel: add requests that came in by email, phone, support chat, mail or social media.
-
Accept or reject: review each request and accept or reject it from the dashboard.
-
One place: every request, from the form or added by hand, sits in the Active Requests tab until it's completed.
Track the deadline on every DSAR
Enzuzo works out which privacy law applies to a request and how much time is left to complete it, then sends reminders as the due date gets close.
-
Days left: the dashboard shows how many days are left on each request.
-
Reminders: automated due-date reminders.
-
Reports: on Growth, Pro and Enterprise plans, DSAR reports, an audit trail and a compliance report.
How long a business has to answer a DSAR
Each privacy law sets its own clock for access requests. These are the deadlines and extensions in each law's own text, as of November 2026.
| Law | Deadline | Extension |
|---|---|---|
| GDPR (EU) |
One month from receipt of the request
|
Up to two more months for complex or numerous requests. The person must be told within the first month, with reasons.
|
| UK GDPR |
One month from receipt, or from when requested ID details or a fee arrive, if later
|
Up to two more months for complex or numerous requests, with notice within the first month. The clock pauses while the business waits for details it needs to know what the request covers.
|
| CCPA (California) |
45 calendar days from receipt, for requests to know, delete or correct
|
One more 45 days, with notice and the reason within the first 45 days
|
| PIPEDA (Canada) |
30 days after receipt
|
Up to 30 more days in set cases, or longer to convert the data to an alternative format. Notice is due within 30 days.
|
| Quebec private sector act (Law 25) |
30 days after receipt. No reply counts as a refusal.
|
The business can't extend on its own; it can ask the Commission d'accès à l'information.
|
| LGPD (Brazil) |
Immediately in simplified form, or within 15 days of the request for a full declaration
|
None in the law. The ANPD can set different deadlines for specific sectors.
|
Read up on DSARs
DSAR questions, answered
What is DSAR software?
DSAR software collects data subject access requests, keeps them in one place and tracks each one against its deadline. With Enzuzo, requests come in through a form on the website or in the privacy policy, requests sent by email or phone are added by hand, and the dashboard shows how many days are left on each one.
Finding the personal data across a business's systems and deciding what to send back stays with the business's own team.
What is a Data Subject Access Request (DSAR)?
A data subject access request (DSAR) is a request from a person to an organization that holds personal data about them, asking whether it processes their data and for a copy of it. The term comes from the GDPR, which gives every data subject this right of access.
Other laws use their own names: the CCPA calls them consumer requests, and they also cover deletion, correction and opting out of the sale or sharing of personal information.
Who can submit a DSAR?
Under the GDPR, any data subject: an identified or identifiable person whose personal data an organization processes. They don't have to be a customer.
Under the CCPA, any California resident can submit a consumer request, including current or former employees, job applicants and contractors, and consumers can also use an authorized agent.
How long does a business have to respond to a DSAR?
It depends on the law. The GDPR and UK GDPR allow one month, the CCPA 45 calendar days, PIPEDA and Quebec's private sector law 30 days, and Brazil's LGPD up to 15 days for a full answer. Four of these six laws let the business extend the deadline in limited cases, set out in the table above.
Can a business charge a fee for a DSAR?
Usually not. The GDPR requires responses to be free of charge, and allows a reasonable fee only when requests are manifestly unfounded or excessive. The CCPA requires businesses to deliver the information free of charge, and Brazil's LGPD says requests are handled at no cost to the person.
Quebec's private sector law makes access free but allows a reasonable charge for transcribing, reproducing or sending the information.
Can a business refuse to respond to a DSAR?
Under the GDPR, a business can refuse a request that is manifestly unfounded or excessive, for example because it keeps repeating earlier requests. If it doesn't act on a request, it has to tell the person why within one month and explain that they can complain to a supervisory authority.
What happens if a business misses a DSAR deadline?
Under PIPEDA and Quebec's private sector law, missing the deadline counts as refusing the request. Under the GDPR, the person can complain to a supervisory authority, and infringing data subjects' rights can bring fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher.
Track every data request in one place.
Free forever plan available. No credit card required.