By Alisa Fetic
In 2018, the General Data Protection Regulation (GDPR) was created in an effort to give people control over their own data.
The GDPR grants eight data subject rights and one of those rights is the right of access. The right of access enables individuals to retrieve information about the data an organization holds on them and how it is used.
The right of access isn’t new. However, the GDPR expands the right of access with new obligatory categories of information that the organization must provide. The GDPR also makes it easier for people to submit their requests and access their data.
The data subject access request (DSAR) is one of the most commonly requested pieces of information organizations receive. If your organization hasn’t already received a DSAR, it likely will in the near future. Here is everything you should know about DSAR.
Data Subject Access Request (DSAR) Definition
A Data Subject Access Request (DSAR) is a request made by an individual to an organization that gives the individual a right to obtain information about how the organization is using their personal data. In compliance with the GDPR, individuals must have the ability to submit DSARs easily at reasonable intervals in order to be aware of, and verify, the lawfulness of the organization’s data processing.
What information are you obligated to provide in a DSAR response?
When responding to a DSAR, an organization must provide confirmation that they are processing personal data and retaining a copy of that personal data. The organization is also obligated to provide:
- Purpose of personal data processing
- Third-parties with whom the organization is sharing personal data, if any
- Categories of personal data the organization is processing
- Source of data (if the data is not collected from the individual)
- Data retention period
- Information about automated decision-making (including profiling)
- Information about their GDPR rights (right to rectification, right to erasure, restriction of processing)
Who Can Submit a DSAR?
Anyone whose personal data the organization is processing can submit a DSAR. This includes employees, customers, partners, and contractors. A DSAR can be submitted at any time and the requesting individual is not obligated to provide a reason for the request.
A DSAR can also be submitted by an individual authorized by the data subject on their behalf. Examples of this include:
- A parent submitting DSAR on behalf of a child
- Legal representative submitting DSAR on behalf of a client
- Relative or a friend
- Individual appointed as a legal guardian
If a DSAR is submitted on someone else’s behalf, the organization has a right and an obligation to ask for a written authorization or other documents that verify the authorization.
Verifying the Identity of the Data Subject
Recital 64 of the GDPR states that the organization must use all reasonable measures to verify the identity of the person submitting a DSAR. Commonly used methods of verifying a data subject’s identity are via email and via photo ID.
Who should respond to a DSAR
The organization’s Data Protection Officer (DPO) should respond to a DSAR. However, not every organization is obligated to appoint a DPO.
If your organization does not have an appointed DPO, there should be one individual within the organization, such as a compliance officer, who is familiar with the GDPR and DSAR processes. The compliance officer must keep track of all DSARs to ensure they are resolved in a timely manner.
However, the DPO or compliance officer does not have to respond to each and every DSAR themselves. Rather, the DPO or compliance officer should oversee and manage the process and assure compliance.
Deadline for Responding to the DSAR
A DSAR must receive a response without undue delay and within one month of receipt of the request.
The response deadline can be extended by two months if the request is complex or if the organization has received several requests from the same individual.
Can You Refuse to Respond to a DSAR?
There are two scenarios when an organization can refuse to respond to a DSAR.
- The request is manifestly unfounded. This means the requesting individual has no real intention of exercising the right of access or the request has malicious intent and no other purpose other than to cause a disruption.
- The request is manifestly excessive. This means the DSAR is obviously unreasonable and far exceeds the cost or other burdens involved with DSAR.