Data Subject Access Request (DSAR)

Data Subject Access Request (DSAR) refers to when an individual (data subject) is exercising their right to request any data collected on them, from an organization. This data is processed by a data controller who must provide the purpose of collecting such data in the first place.

Data subjects are entitled to submit this request at any time, and the organization is obligated to respond and supply a copy of any relevant personal data regarding the subject.  

As a data subject you can ask for this information from anyone representing the specific organization, through a verbal or written request, and even on social media.

As an organization, you must reply within a one-month time-frame (2 months in case of a more complex case). You should also deliver this information in an accessible format and in a secure way.

DSARs have already been used for quite some time by organizations and governments. There are a few exceptions that can release organizations from providing information to data subjects, where it is in conflict with other rights such as public or national security, as well as other individuals’ human rights.  

‍