Deal With a Data Subject Access Request (DSAR)
Take the “arghhh” out of a DSAR with our experts on your side. But, what is it? Let's dive in
GDPR gives individuals rights surrounding how their personal information is processed by businesses. One of those rights is “the right of access” or “subject access” which allows a member of the public such as a customer, employee or supplier to ask a business about what data they hold about them.
This is a data subject access request (or DSAR). DSARs are nuanced, often requiring a little finesse to navigate. They are also quite time sensitive, and the strict criteria that must be followed to action them can make the process complicated, especially where large amounts of data are held. So, we’re here for you to lean on when the going gets tough.
What comes with a DSAR?
Tight deadlines- A business must respond within one calendar month from the day of receipt of the data request. Time is of the essence to remain compliant. Tick tock!
Training staff - Do your staff know how to respond to a DSAR? Do they know where and how they should look for the data that has been requested? (This ties in neatly with having clear and easily accessible documents and policies in place that your workforce can use with ease.)
Detailed investigation – Some requests will take more effort to analyse than others. Understanding what you need to disclose vs what is excessive is a delicate balancing act – and we’ve mastered it.
Who can this affect?
HR and People:
Data Subject Access Requests are commonly made by disgruntled employees, or those facing disciplinary action. They can be time-consuming and disruptive, so it’s important that businesses and their HR functions know how to recognise them, alongside understanding who has responsibility for coordinating a response, and what procedures need to be followed.
Directors and CEOs:
It’s important to appoint someone in your organisation as the main point of contact for data-related requests. For some businesses, this means appointing a data protection officer (DPO), but this isn’t always necessary, and can in itself become a burden on the business that leads to more hassle than help.