How to make a DSAR (Data Subject Access Request) 

I want my data, how do I get it? 

DSARs, or data subject access requests, are available to all members of the general public who want to know what data organisations hold about them. In this article, our Consultant Compliance Counsel Mandy Hargun discusses how to make a DSAR and some other FAQs. Mandy is a lawyer specialising in data protection.  

What is a DSAR? 

A data subject access request (DSAR) is a request made by an individual (the data subject) for a copy or access of their personal data. 

What rights do I have surrounding my personal data? 

Data subjects have the right to access any personal data that organisations hold about them. The best way to exercise this right is by submitting a data subject access request (DSAR). 

How to make a DSAR 

So, you want to know what data an organisation holds about you. How can you make a DSAR? 

When making a data subject access request, here are some key things to consider: 

• Make sure it’s clear that you’re making a DSAR, for example by including a heading such as ‘Data Subject Access Request’. Also be sure to include the date you’re making the request.
• Understand the purpose of making the DSAR, whether it is to access, update, or delete your personal information. You don’t have to include this information, but it can help the organisation deal with your request more efficiently.
• Make sure to include necessary information such as your full name and contact details. 
• Further details such as your employee number, account details, or product number may also be helpful to include.
• Include how you would like to receieve the information (e.g. via email or post)
• If you have any accessibility requirements, such as a larger font, make sure you mention this in your request.
• Consider the communication channel you’re using. You do not need to make the request in writing, a DSAR can be made via email, phone call or even direct message (DM). It is the organisation’s responsibility to ensure that making a DSAR is straightforward.  

How long does a DSAR take? 

Organisations have one month to respond to your request. However, they may extend this time for a further two months if you have a complex request or have made multiple requests. However, they must let you know that they are extending the time within one month of you making the request. Organisations often respond stating a response will be forthcoming or that exemptions apply. 

They may also respond asking you for further information, such as verifying your identity, and do not have to continue working on your request until you get back to them. So, it’s important to always respond even if you cannot or will not give them the information they are asking for.  

What should I do once I’ve made a DSAR? 

Once the organisation responds, take the time to review the information provided. Organisations often provide a dump of information with heavy redactions that can be difficult to understand. A lawyer may be able to assist you.  

Do I need legal advice to make a DSAR?  

If you are in the process of, or wish to obtain your data, a lawyer may be able to assist you in the process and help ensure you get what you need. At Setfords, our expert privacy lawyers are here to help. We can advise you of the remedies available to you if your DSAR is not processed in accordance with data protection legislation. Get in touch to find out more.