Definition
A data subject request is a privacy-rights request made by a person whose personal data is being processed. Common requests include asking what data an organization holds, receiving a copy of it, correcting inaccurate information, deleting it, restricting processing, receiving it in a portable format, or objecting to a particular use. The exact rights and exemptions depend on the law that applies.
The ICO guide to individual rights describes these rights, while its subject access guidance explains that an access request can be made verbally or in writing and does not require special wording.
In practice, an organization needs a repeatable process to recognize the request, verify the requester where appropriate, locate relevant records, review what can be disclosed or changed, and respond securely. For a request involving a digital analytics service, the organization may need to coordinate with a processor that holds or processes identifiers such as cookie IDs, IP addresses, or other online signals.
What does that mean
If someone asks a company to show, correct, delete, or stop using information about them, that message may be a data subject request. The company checks what applies, finds the relevant data, and responds securely.
Why this matters
A clear DSR process helps people exercise privacy rights and helps organizations meet legal deadlines. For Data and IT teams, it means searchable records, reliable identity matching, controlled exports or deletions, and clear processor handoffs; for customer-facing teams, it means routing requests quickly without promising an outcome before the privacy review is complete.
Use cases
Finding and returning a person’s data
Relevant for: Data; IT
A requester may want to know whether an organization processes their data and receive a copy of the relevant information. The challenge is that the information may be distributed across customer records, analytics systems, support tools, and service providers.
A DSR process gives Data and IT teams a way to verify the request, match the person to the right records, search systems and processors, remove unrelated people’s information, and assemble a secure response.
The expected benefit is a more complete and understandable response, with less risk of overlooking a system or disclosing another person’s data.
Handling deletion, correction, or objection requests
Relevant for: Data; IT
A person may ask an organization to erase inaccurate data, stop a particular use, or restrict processing. These requests can be difficult when data is replicated across applications, warehouses, backups, or third-party services.
The organization maps the request to the relevant systems, applies the applicable legal and operational rules, records any exception, and sends the necessary instructions to processors. Some requests require deletion; others require correction, suppression, or a documented explanation of why a request cannot be fulfilled in full.
The expected benefit is better control over retention and downstream copies, while preserving an audit trail of what was done and why.
Coordinating with a data processor
Relevant for: Data; IT
An organization may receive a request about data processed by a platform provider. The organization remains responsible for responding to the individual, but it may not have direct access to every underlying record or the technical ability to complete every step alone.
The DSR workflow defines the controller–processor handoff: the customer forwards the relevant request, the processor locates or acts on the requested data within its role, and both parties follow the applicable instructions and agreement. Contentsquare’s DPA states that customers act as controllers, Contentsquare generally acts as processor for the service, and Contentsquare can assist with requests that customers cannot address through the service alone.
The expected benefit is clearer accountability, faster routing, and fewer delays caused by uncertainty about who should take the next step.
How Contentsquare helps
Data Subject Request Portal provides a dedicated route for sending a request to Contentsquare. The current portal states that submissions are handled through a form hosted by OneTrust.
Contentsquare’s GDPR guidance explains the controller–processor responsibilities relevant to customer requests and identifies a route for Data Subject Requests.
Contentsquare’s Data Processing Agreement documents cooperation for DSRs: customers forward relevant requests, and Contentsquare can provide appropriate technical and organizational assistance when the customer cannot address a request through the service alone.
Session Replay automatically masks personal information such as card and bank details, helping reduce exposure while teams analyze customer experiences.
Smart Capture supports anonymous, aggregated analysis and is presented by Contentsquare as a way to capture interactions without compromising privacy; it is a data-collection safeguard, not a substitute for a DSR process.
Data Connect syncs selected experience datasets to a governed data warehouse and describes its integrations as GDPR-compliant, which can support controlled data inventory and access workflows. It does not itself determine whether a request must be fulfilled.
FAQs on data subject requests
A data subject request is the broader term for a request to exercise a privacy right. A data subject access request, often shortened to DSAR or SAR, is the specific type that asks an organization to confirm whether it processes someone’s personal data and provide access to it.
Terminology varies by jurisdiction and organization, so it is useful to read the person’s intent rather than reject a request because they did not use the expected label.