Data Subject Access Request
Export all data for a contact (DSAR)
Data Subject Access Request (DSAR)
Under GDPR Article 15 and similar regulations worldwide, individuals have the right to request a copy of all personal data you hold about them. Mailnaptic makes it easy to fulfill these Data Subject Access Requests by providing a comprehensive data export for any contact.
What Is a DSAR
A Data Subject Access Request is a formal request from an individual to know what personal data you are processing about them, why you are processing it, and who you are sharing it with. You must respond within one month of receiving the request, providing the data in a commonly used, machine-readable format.
Generating a DSAR Export
- Navigate to Contacts and search for the contact who submitted the request.
- Open the contact's detail page.
- Click the Actions menu and select Export Contact Data (DSAR).
- Mailnaptic compiles all data associated with the contact and generates a downloadable file.
- Review the export before sharing it with the individual to ensure it doesn't accidentally include data about other contacts.
Data Included in the Export
The DSAR export contains a comprehensive snapshot of all data Mailnaptic stores about the contact:
- Personal information: Name, email address, phone number, and all custom field values.
- Consent records: When and how consent was obtained for each processing purpose, including IP address and method (form, API, import).
- Subscription preferences: Current topic opt-in/opt-out settings and frequency preferences.
- List memberships: All lists the contact belongs to with join dates.
- Tags: All tags applied to the contact.
- Email activity: A history of emails sent to the contact, including opens, clicks, bounces, and complaints with timestamps.
- Web activity: Site tracking events (page views, custom events) if site tracking is enabled.
- Automation history: Records of any automation workflows the contact has passed through.
- Preference changes: A log of all changes the contact has made to their subscription preferences.
Export Format
The export is generated as a JSON file, which is a structured, machine-readable format that satisfies GDPR's requirement for portability. If the individual requests a different format, you can convert the JSON to CSV or PDF using standard tools.
Verifying the Requester
Before fulfilling a DSAR, you must verify the identity of the requester to ensure you're not disclosing personal data to an unauthorized party. Mailnaptic does not handle identity verification — this is your responsibility as the data controller. Common verification methods include confirming the request came from the email address on file or requesting government-issued identification.
Logging the Request
Mailnaptic records each DSAR export in the audit log, including the date, the admin who initiated it, and the contact affected. This provides an accountability trail showing you take data subject rights seriously.