Failing to respond to a DSAR can lead to serious legal and financial consequences. Under the GDPR, companies can face fines of up to 4% of their global annual revenue or €20 million, whichever is higher.