If you are reading this because an email has just arrived, the short answer is: somebody is asking what personal data you hold about them, you have to answer, and the clock started the day the email arrived. Nothing about it is an emergency, and the way to keep it that way is to do three things today.
What it is, in one paragraph
A data subject access request is a person exercising a right to know what an organisation holds about them and to receive a copy of it, along with the purposes it is used for, who it is shared with and how long it is kept. In the United States the equivalent under California law is called a verifiable consumer request. The name differs; the work does not.
Three things to do today
Write down the date the request arrived and where it came from. Reply to say you have it and that you are dealing with it. Decide whether they want a copy, a deletion or a correction, and ask if it is not clear. That is the whole of day one, and it removes almost all of the risk of the process going wrong later.
What you have to send, and when
A copy of their personal data, plus the context above. California Civil Code section 1798.130(a)(2) requires it within 45 days of receipt, extendable once by another 45 days on notice given inside the first period. GDPR Article 12(3) requires it within one month of receipt, extendable by two further months where the request is complex.
What usually goes wrong
Not the answer, the search. Personal data is in the CRM, the helpdesk, the mailing tool, the billing system and at least one spreadsheet, and the time goes into remembering that rather than into writing. Making the list once, before the next request, is the single highest-value hour available.
Questions people ask about what is dsar
Do I have to answer if we are a tiny company?
Probably yes if the person is covered by a regime that reaches you. Size thresholds exist in California but not under the GDPR, and in any case a short honest answer costs far less than the argument about whether you had to give one.
Can I just delete everything instead?
No, and doing so after receiving a request is much worse than answering it. Deleting in response to an access request is the one action that turns a routine matter into a serious one.
Do I need a lawyer?
For a first, straightforward request from a customer, usually not. For a request from a former employee, one arriving alongside a dispute, or one where you think something should be withheld, take advice. Nothing on this site is legal advice.