What is a SAR?
A Subject Access Request (SAR), also known as a Data Subject Access Request (DSAR), is the formal exercise by an individual of the right under GDPR Article 15 (and KVKK Article 11) to obtain confirmation of whether personal data is being processed, a copy of that data, and supplementary information (purposes, categories, recipients, retention, source, rights, ADM logic). The right is gateway to the broader data subject rights toolkit.
Operational SAR mechanics
- Receipt and acknowledgement: via any channel: email, postal, web form. Article 12 requires reasonable accessibility.
- Identity verification: proportional; do not demand excessive proof.
- Response deadline: one month under GDPR (extendable two more months for complexity); KVKK 30 days.
- Cost: free in most cases; manifestly unfounded/excessive requests can attract a reasonable fee or refusal.
- Format: in a commonly used electronic form where requested electronically; clear, intelligible language.
Common SAR challenges
- Third-party data: redact identifying information of others appearing in the responsive set.
- Confidential business information: may be withheld where it would adversely affect rights of others.
- Privileged communications: legal advice privilege may apply.
- Volume: large discovery-style SARs in litigation contexts require scoping and reasonable interpretation.
SAR under KVKK
Under KVKK Article 13 and the Communiqué on the Procedures and Principles of Application to the Data Controller, requests are made in writing or by registered electronic mail (KEP), secure electronic signature, mobile signature or other methods determined by the Board. The controller must respond within 30 days, free of charge; where the response entails an additional cost, the fee in the Board’s tariff may be charged (currently TL 1 per page above 10 pages, and the cost of the medium for a CD or USB drive). If the request is refused, the answer is insufficient or no answer is given in time, the data subject may complain to the KVKK Board within 30 days of learning the response and in any case within 60 days of the request (KVKK Article 14).
Do: publish a clear SAR process with multiple channels; train front-line teams to recognise and route requests; maintain a SAR log.
Don’t: stall, over-verify, or apply blanket refusals: EU DPAs regularly fine inadequate SAR handling, and the KVKK Board can order a remedy whose non-compliance is fined (KVKK Articles 15 and 18).
Sources. Regulation (EU) 2016/679 (GDPR) and Law No. 6698 on the Protection of Personal Data (KVKK). Statute links open the official consolidated Turkish texts on mevzuat.gov.tr.