A data subject request is any request from someone whose personal data you process, in which that person exercises one of the rights that the GDPR grants them. This goes beyond the two best-known forms, access and deletion. The regulation also recognizes the right to rectification, the right to restrict processing, the right to data portability and the right to object to a particular processing activity. All these requests fall under the same umbrella and trigger the same obligation: you must respond to them.
The detail most often overlooked in this subject is that a request does not need to take any particular form. A customer who writes in a regular email "I want to know what you have about me" or a former employee who says at the desk "can you remove my name from your system" is already making a request, even without a form, without using the word GDPR and without it coming through a designated contact person. It is precisely this informal receipt that often goes wrong: not in fulfilling the request, but in recognizing it.
What rights fall under a data subject request
The GDPR grants someone whose data you process a number of interrelated rights. Access means that someone can find out what data you hold about them and what it is used for. Rectification means that inaccurate data must be corrected. Erasure, also called the right to be forgotten, means that data must be deleted in certain situations. Restriction means that data can temporarily no longer be used, for example during a dispute about its accuracy. Portability gives someone the right to receive data they have provided themselves in a commonly used format. And the right to object gives someone the ability to challenge a specific processing activity, for example the use of their data for marketing.
None of these rights is unconditional. The GDPR attaches its own conditions and exceptions to each right, and whether a request must actually be granted depends on the situation. This is precisely why general information here can never replace a judgment about an individual case.
Why recognition is more difficult than handling
Many organizations focus their attention on the process after a request arrives: who responds, within what timeframe, with what document. That is right, but it is not the first bottleneck. The first bottleneck is that a request rarely arrives through the channel you set up for it. It arrives with the employee who answers the phone, with the colleague who manages the customer service mailbox, or with the office manager who happens to be in the lobby. If nobody in your organization knows that such a sentence is already a request, the clock starts running for you without you knowing it.
This is also the reason why supervisory authorities emphasize in their guidelines that a request is not tied to any particular channel or specific wording. The responsible organization, not the data subject, bears the burden of recognizing a request as soon as it is made. the knowledge base with explanations for each right of the data subject provides more detail on what counts as a valid request for each of these rights and what does not.
What this means for your organization
In practice, it works best if everyone who has customer contact knows that phrases like "remove me from your records" or "send me everything you have about me" are signals to pass on to whoever handles requests. This is not legal training; it is pattern recognition. Only once the request has been identified and passed on does the question arise of how you identify it, what exactly you must provide, and within what timeframe.
The GDPR itself sets a one-month period for responding to a request, with the possibility of extending it in more complex cases. This period begins to run from the moment the request is made, not from the moment it reaches the right person. Anyone who wants to monitor this period without having to remember it manually can have it run automatically via a system that starts the clock automatically. how gdpria.eu monitors this period explains what this automation is based on.
What you can do if you are unsure
Not every message that looks like a request is one, and not every request must be fully granted. Doubt about this is part of the execution, not the recognition: as soon as someone indicates that they want to exercise one of their rights, it is your responsibility to treat that seriously and assess what exactly must happen, if necessary with a lawyer or the Authority for Personal Data. answers to questions that businesses often ask about this covers a number of these borderline cases.
Do you want to know where your organization stands before a request actually arrives? The free quick-scan on makes data breaches and requests understandable in a few questions provides a first indication, and the knowledge base explains per right what the GDPR says about it, including the source.