What Happens If You Miss the DSAR Deadline
A missed data subject request deadline isn't automatically a fine, but it does change your position significantly. Here's what actually happens, and what to do if you're about to run out the clock.
Missing a data subject request deadline doesn’t trigger an automatic penalty the way, say, a late tax filing might. But it does materially change your position, both legally and in how the requester is likely to respond.
What doesn’t happen immediately
There’s no automatic fine the moment a deadline passes. Enforcement under GDPR and CCPA/CPRA generally requires either a complaint from the individual to a regulator, or the regulator identifying a pattern through other means. A single late response, especially one resolved shortly after the deadline with a reasonable explanation, is unlikely on its own to trigger formal action.
What actually happens
- The requester escalates. The most common consequence is the individual filing a complaint with the relevant authority, an EU/UK data protection authority or the California Privacy Protection Agency, once they realize you’ve gone past the window without a response or extension notice.
- You lose the extension option. Both GDPR and CCPA/CPRA require you to notify the requester of an extension before the original deadline expires. Miss that window and you’ve generally forfeited the ability to claim the extra time, the full response is now overdue, not just delayed.
- It becomes evidence of a pattern. A single late response is a mistake, regulators and plaintiff’s counsel pay more attention when it’s one of several, since that suggests a systemic process failure rather than a one-off.
If you’re about to miss it
- Respond immediately, even if incomplete. A late but substantive response, with an honest explanation, is better than continued silence.
- Acknowledge the delay directly rather than responding as if the deadline hadn’t passed. Requesters and regulators both respond better to acknowledgment than to a response that ignores the lapse.
- Fix the process gap, not just this instance. A missed deadline is usually a symptom of an unclear intake process, document what broke and change it.
Enzuzo
The most common reason for a missed deadline isn't a hard case, it's a request that wasn't recognized as a DSAR when it arrived. Enzuzo's data subject request handling gives incoming requests a defined intake path instead of letting them land as an unlabeled support ticket.
The real risk profile
For most small and mid-size businesses, the practical risk of a single missed deadline is lower than it feels in the moment, but the risk compounds with repetition, and with the perceived seriousness of the underlying data. A missed deadline on a newsletter unsubscribe request carries very different weight than a missed deadline on a request involving financial or health-adjacent data.
The bottom line
A missed DSAR deadline is a problem to fix quickly and honestly, not a crisis to hide from. The businesses that get into real regulatory trouble over this are the ones with a repeated pattern of missed or ignored requests, not the ones that respond late once and correct course.
This guide is educational and not legal advice. For your specific situation, consult a privacy attorney.