What is Data Subject Access Request?

A data subject access request is a formal request from an individual to see the personal information an organization holds about them and to learn how it is used and shared. Canadian privacy laws, including PIPEDA and Quebec's Law 25, grant individuals rights to access and correct their personal data, and Law 25 adds portability rights. For a dealership, a customer could request the credit application data, contact records, marketing consent history, or CRM notes you hold on them. You must respond within legally required timelines, verify the requester's identity, and provide the information in an understandable form while protecting other people's data. Having organized, searchable customer records makes responding straightforward. Designating a privacy contact and documenting a response process ensures you handle these requests correctly and demonstrate compliance if a regulator asks.