DSAR
A data subject access request (DSAR) is a request by an individual to an organization to confirm whether it processes their personal data and to receive a copy of that data with information about how it is used.The right comes from Article 15 of the GDPR. The person is entitled to confirmation that their data is processed, a copy of it, and information on the purposes, the categories of data, the recipients, the retention period or the criteria for it, the source if the data was not collected from them, the existence of automated decision-making, and the safeguards for transfers outside the EEA. The first copy is free; further copies can carry a reasonable fee. Under Article 12, the answer is due within one month, extendable by two further months for complex or numerous requests, and the controller may ask for additional information when it has reasonable doubts about the requester's identity.
In California the equivalent is the request to know under sections 1798.110 and 1798.115 of the Civil Code, answered within 45 days, extendable once by 45 days with notice to the consumer.
For website data the hard part is matching. A visitor who writes in by email is not obviously linked to a cookie identifier, so the site needs a method, such as asking for the identifier shown in the cookie settings, to find their records in analytics tools and in the consent log without disclosing someone else's data. Over-collecting identity documents to verify a request creates its own risk. See data subject rights for the full list.