Since the enforcement of the GDPR in 2018, Data Subject Access Requests (DSARs) have become a vital tool for individuals to access the personal data held about them. However, five years in, regulators are now overwhelmed. According to recent reports from European data protection authorities, including the ICO (UK) and CNIL (France), there has been a sharp increase in complaints relating to DSARs — particularly regarding non-responses or delays from companies.
While GDPR mandates a one-month response time (extendable by two months in complex cases), many individuals are now waiting 12 to 16 weeks for their complaints to even be reviewed by the regulatory body — let alone resolved. In Ireland and France, backlogs are being attributed to a surge in DSAR complaints from employees, consumers, and digital users — particularly involving large tech platforms.
Why This Is Happening
- Volume Overload: An increase in awareness and easy-to-use DSAR tools has led to a flood of access requests.
- Regulatory Bottlenecks: Authorities like the EDPB, ICO, and DPC have limited staff and are prioritizing large-scale investigations.
- Inadequate Responses by Companies: Many organizations delay, redact excessively, or ignore requests, prompting user complaints.
- Cross-border complexity: Requests involving multinational firms take longer due to jurisdictional coordination.
What This Means for Individuals and Organizations
For individuals, this means that even after filing a complaint, it may take months to get a decision or resolution. For organizations, this trend highlights the urgency of strengthening internal DSAR processes — delays are not just a reputational issue, but now a legal risk.
⏱️ Takeaway: If you’re filing a complaint over a mishandled DSAR, expect a waiting period of 16 weeks or more in many EU jurisdictions. Patience is key — but it doesn’t absolve organizations from meeting deadlines.
- We can help you become FADP compliant!
Expert Guidance, Affordable Solutions, and a Seamless Path to Compliance
