The basics of Data Subject Access Requests (DSARs) and how to respond

 

What is a DSAR?

A Data Subject Access Request, often known as a DSAR, is a written request from an individual to a data controller (company holding personally identifiable information) asking for the information held about that individual. However, there is no prescribed form. The request should have a reasonable explanation as to why the request is being made.

Are employee DSARs different from “regular” DSARs?

Although employee DSARs are technically the same as any other DSAR, the personal data held by an employer about an employee is often more comprehensive than what another organization might hold about an individual. For instance, information could include employment history, health information, bank details, disciplinary actions, annual review and performance, or more.

How long do I have to respond to a DSAR?

The data controller has 30 days to respond to a DSAR and provide the data requested. The period can be extended by up to two additional months by informing the employee within one month of the request of the need for the extension, and the reasons why.

What should I do next?

When you receive a request, there are a few steps to take immediately. Forward the request to your organization’s Data Protection Officer. He or she should have a protocol in place of how to respond.

Comments

Popular posts from this blog

5 STEPS TO BUILDING AN EFFECTIVE DOCUMENT REVIEW PROCESS

LDM Global Launches Data Subject Access Request Solution

Demystifying Legal Jargon: A Plain Language Guide for Clients