DSAR (data subject access request)

How to recognise a DSAR

A data subject access request gives someone the right to ask for their personal data and information about how it is being used. The request can arrive by email, letter, message or conversation. It does not need to mention “DSAR”, “SAR” or data-protection law.

An employee might ask to see their HR file, emails about them or the information used to make a decision. Treat the date the request arrived as important. Organisations normally have one month to respond, although the exact deadline and any permitted extension depend on the circumstances.

What a good response involves

First, confirm what the person is asking for. Check their identity only where this is necessary, and keep the check proportionate. Then carry out a reasonable and proportionate search across the places where their information may be held.

The response usually includes a copy of the person's data plus supporting information, such as the purposes for processing it, who it has been shared with and how long it will be kept. Information about other people may need to be redacted or handled separately.

Keep an audit trail

Record when the request arrived, who is responsible, where you searched and when you replied. Note why anything was withheld or redacted. Do not delete or change relevant information after receiving the request.

Requests involving legal privilege, third-party information or an exemption need extra care. Use the ICO's current subject-access guidance and record the basis for any information you withhold.