What is a DSAR?
Data subjects have the right to know that an organisation is processing their personal data and may request a copy of such personal data.
A data subject access request, sometimes referred to as a subject access request or a SAR is a request made by an individual to access the personal information that is held by an organisation.
The data subject access request will ask for some or all of the following:
- What personal data an organisation holds about the individual
- How the organisation uses this personal data
- Who the data is being shared with
- Where the data came from.
An individual is only entitled to their own personal data, and not to information relating to other people (unless the information is also about them, or they are acting on behalf of someone).
The subject access request can be made verbally or in writing, including on social media.
DSARs must be fulfilled without delay and the time. Under some legislations, the organisation can extend the time limit by a further two months if the request is complex or if the same individual has made a number of requests.