Data subject access request (DSAR)
D-S-A-R
In one sentence
A consumer's request to see all personal data a controller holds about them. Must be served within 30 days under GDPR. UGC programmes must be able to surface every consented asset for a named creator.
Read more on this
Strategy
GDPR + UGC Compliance: The Operational Manual for 2026
GDPR treats reused customer content as personal-data processing: consent per asset, a searchable audit trail, and a 30-day end-to-end withdrawal SLA.
Strategy
GDPR, consent and UGC
UGC shows identifiable people, so it is personal data under GDPR. A defensible programme records scoped permission, honours removal requests, and minimises what it holds.
Strategy
CCPA and Customer Reviews: US Brand Compliance Guide
Reviews are personal information under CCPA: disclose collection, honour deletion in 45 days, offer a one-step opt-out, or risk $7,500 per intentional violation.
See it working on a live store.
Real storefronts using the thing this page defines.
