The expensive mistake with DSARs is not mishandling one. It is not recognising one, because the deadline runs from the day it arrived whether or not anybody filed it as a request. This page is what counts as one, and what to do in the first hour.
There are no magic words
A request does not have to say DSAR, cite a law, use a form or arrive at a privacy address. What do you have on me in a reply to a marketing email is a request. So is a support ticket asking for an account export, and so is a phone call under the GDPR, which accepts verbal requests. The test is substance, not form.
Which means every inbox is an intake
Support, sales and the info address all receive them. The practical control is a two-line rule everybody knows: if somebody asks about their own data, forward it to one place today and say when it arrived. That rule is worth more than any policy document about DSARs.
The first hour: log, acknowledge, classify
Log the receipt date and channel. Acknowledge to the person, which costs nothing and dramatically lowers the chance the request becomes a complaint. Classify it as access, deletion, correction, portability or opt-out, because the work behind each is different.
What you are working against
California Civil Code section 1798.130(a)(2) gives 45 days from receipt, extendable once by an additional 45 days when reasonably necessary with notice inside the first period. GDPR Article 12(3) gives one month from receipt, extendable by two further months where the request is complex or numerous. Both are measured from receipt.
Questions people ask about dsar request
Can we ask them to use our form?
You can offer it. You cannot require it, and refusing to act on a request because it came the wrong way is the fastest route to a complaint that succeeds.
What if the request is enormous?
Scope it by asking, and use the extension if it genuinely applies, with notice. What you must not do is quietly take longer, because an unexplained overrun is the thing regulators actually act on.
Does an ex-employee have the same right?
Yes, and employee requests are usually the hardest, because the data is in more systems and more of it involves other people. Scope and the withholding basis matter more here than anywhere.