Obtain Personal Data with a Data Subject Access
Use our SAR or DSAR Template to Secure Evidence.
What is the Data Subject Access Request
A Subject Access Request (SAR), also commonly referred to as a Data Subject Access Request (DSAR), is a right under Article 15 of the UK General Data Protection Regulation (UK GDPR).
It allows individuals to obtain confirmation from an organisation or employer as to whether or not it processes personal data relating to them.
If personal data is indeed being processed, the organisation must provide the individual with access to that data, including a copy. This is a good way of getting documentary evidence from an employer.
Why should I make a Data Subject Access Request (DSAR) or Subject Access Request (SAR)?
The primary use of a DSAR is to allow you to:
Obtain confirmation from an organisation as to whether or not they process personal data relating to you.
If they do process your personal data, they gain access to that data, including receiving a copy of your personal data.
Beyond simply obtaining a copy of your data, a DSAR is helpful because it compels the organisation to provide comprehensive information about how your data is being handled. This includes details such as:
The purposes for which your personal data is being processed.
The categories of personal data involved.
The recipients or categories of recipients to whom your data has been or will be disclosed, particularly if they are in third countries or international organisations.
Where possible, the envisaged period for which the personal data will be stored, or the criteria used to determine that period.
Information about your right to request rectification or erasure of personal data, restriction of processing, or to object to such processing.
You have the right to complain with the Information Commissioner (ICO).
Any available information about the source of your personal data, if it was not collected directly from you.
The existence of automated decision-making, including profiling, along with meaningful information about the logic involved and the significance and envisaged consequences for you.
What appropriate safeguards are or were in place if your data has been transferred to a third country or an international organisation?
Current or Former Employee
A DSAR can be made by various individuals, including current or former employees, workers, or contractors, as well as job applicants. It can also be used to request information on behalf of someone else, such as a child or a relative, provided you can supply proof of their identity and your authorisation to act for them.
Narrow Your Data Request
While you can make a broad request for "any information that the employer processes about me," focusing or limiting your request by referring to specific subject matter or dates can often make it more effective. You can also use a DSAR to ask the organisation to help facilitate your request, for example, by asking them to specify who was involved in a particular decision or matter.
