DSAR stands for data subject access request: a person asking an organisation what personal data it holds about them. That is the literal meaning. The useful meaning is broader, because the route a business builds to answer one almost always has to answer four other things as well.
The four letters
Data subject is the person the data is about. Access is the right to be told what is held and to receive a copy. Request is the ask, in any form. The term comes from European data protection law and has been adopted much more widely than the law itself, which is why US businesses use it for California requests too.
The five rights one route usually carries
Access, deletion, correction, portability and objection or opt-out. They arrive at the same place, they are counted against the same clock, and the work behind them differs completely: access is a search, deletion is a change across systems, and correction is a change you have to propagate to anyone you gave the old value to.
What the person is entitled to receive
Under Article 15 of the GDPR, a copy of the personal data plus context: the purposes, the categories, the recipients, the retention period and where the data came from. A raw export with no explanation satisfies the first half and not the second, which is a common way to answer a request and still receive a complaint.
What it is not
It is not a right to internal documents that merely mention the person in passing, and it is not a route to the personal data of others. Both come up, and the answer to both is that something was withheld and on what basis, said plainly rather than silently.
Questions people ask about dsar meaning
Is a DSAR the same as a CCPA request?
Not formally, but operationally they run the same way. California uses verifiable consumer request, and the underlying work of identify, scope, search and answer is identical.
Who can make one?
The person themselves, or somebody authorised to act for them. Where an agent asks, you are entitled to check the authority, and you should record what you checked.
How long does answering one take?
The statutory limit is 45 days in California and one month under the GDPR, both from receipt. The real elapsed time is almost entirely the search, which is why the list of systems is the thing worth preparing before the first request arrives.