Data Subject Access Request Template (DSAR or SAR)
Make a Data Subject Access Request (DSAR) With Our Free Template
Understanding Your Right to Access Your Data Under the UK General Data Protection Regulation (UK GDPR), you have the fundamental right to obtain confirmation from an organisation as to whether or not they process personal data relating to you. If they do process your data, they must provide you with access to that data, including a copy of your data. This right is commonly referred to as a "data subject access right" (SAR or DSAR). Our free template is designed to help you exercise this right under Article 15 of the UK GDPR.
Who Can Make a DSAR?
A DSAR can be made by various individuals seeking their personal information. This includes current or former employees, workers, or contractors. It also applies to job applicants who have applied to work for an employer. Furthermore, you can use this service to request information for someone else, such as a child or a relative, provided you can supply proof of their identity and your authorisation to act on their behalf, such as a signed letter of consent or evidence of parental responsibility.
What Information Can You Request?
When an organisation responds to your DSAR, they must provide specific details beyond just a copy of your personal data. This includes:
The purposes for which your data is being processed.
The categories of personal data concerned.
The recipients or categories of recipients to whom your personal data has been or will be disclosed, particularly if they are in third countries or international organisations.
Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period.
The existence of your right to request rectification or erasure of personal data, or restriction of processing, or to object to such processing.
You have the right to complain to the Information Commissioner (ICO).
Where the personal data was not collected directly from you, any available information as to its source.
The existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for you.
What appropriate safeguards are or were in place if your data has been transferred to a third country or an international organisation?
Organisation's Responsibilities and Timelines
Organisations have specific duties when handling a DSAR. They must respond in a way that is concise, transparent, intelligible, and easily accessible, using clear and plain language. They also have a duty to facilitate the exercise of your data subject rights. If you make your request electronically, the organisation should provide the information in a commonly used electronic format, unless you request otherwise.
Generally, an organisation must provide a copy of your personal data free of charge. However, they may charge a reasonable fee or refuse the request if it is considered "manifestly unfounded or excessive". A reasonable fee may also be charged for additional copies of personal data.
One Month Can Be Extended to Three Months
The organisation should provide the requested information without undue delay and in any event within one month of receiving your request. This period can be extended by two further months if your request is complex or if you have made multiple requests. If an extension is needed, the organisation must inform you of this within one month of receiving your request, along with the reasons for the delay. If providing access involves disclosing information about another individual, the organisation is not required to disclose it unless specific conditions are met; supplying information on a redacted basis is also a possibility.
Providing Proof of Identity
While our template includes a provision for you to confirm your identity when making your request, it's important to note that this is not always strictly necessary unless the organisation has reasonable doubts about your identity. However, the ICO suggests providing proof of ID, such as a copy of a passport or driving licence, and proof of address, such as a bank statement or utility bill, to help the process.
A More Effective Request
Tips for a More Effective Request Although there's no strict requirement to narrow down your request, and you can simply ask for "any information that the employer processes about me," your request will often be more effective if you focus or limit it by referring to specific subject matter or dates. You can also ask the organisation to help facilitate your request, for example, by asking them to specify who was involved in a particular decision or matter.
Our DSAR Template
Our template allows you to include details such as:
A general request or specific matters to which your request is confined.
Suggestions for locating personal data, such as individuals who may have processed the data, or specific date ranges for emails.
Any variant spellings of your name or nicknames you are known by, as this can help with searching records, especially email records.
How to Use Our Template
Our template is designed to be straightforward and comprehensive. Fill in the bracketed sections with your specific details:
[ADDRESSEE] and their [ADDRESS].
Your [NAME OF ADDRESSEE].
Details about your relationship with the organisation (e.g., current or former employee, job applicant) and relevant dates or positions.
The scope of your request, whether it's a general request or focused on specific matters or allegations.
Suggestions for locating the personal data, including names of individuals or search parameters for emails and documents. You can also ask for information about individuals involved in specific decision-making.
Any variant expressions of your name.
An optional section to confirm your identity by enclosing a copy of your driving licence or passport.
Remember to keep a copy of your request for your records. The organisation should reply directly to you.
Download Your Free DSAR or SAR Letter Template
Make a Data Subject Access Request (DSAR) With Our Free Template
Understanding Your Right to Access Your Data Under the UK General Data Protection Regulation (UK GDPR), you have the fundamental right to obtain confirmation from an organisation as to whether or not they process personal data relating to you. If they do process your data, they must provide you with access to that data, including a copy of your data. This right is commonly referred to as a "data subject access right" (SAR or DSAR). Our free template is designed to help you exercise this right under Article 15 of the UK GDPR.
Who Can Make a DSAR?
A DSAR can be made by various individuals seeking their personal information. This includes current or former employees, workers, or contractors. It also applies to job applicants who have applied to work for an employer. Furthermore, you can use this service to request information for someone else, such as a child or a relative, provided you can supply proof of their identity and your authorisation to act on their behalf, such as a signed letter of consent or evidence of parental responsibility.
What Information Can You Request?
When an organisation responds to your DSAR, they must provide specific details beyond just a copy of your personal data. This includes:
The purposes for which your data is being processed.
The categories of personal data concerned.
The recipients or categories of recipients to whom your personal data has been or will be disclosed, particularly if they are in third countries or international organisations.
Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period.
The existence of your right to request rectification or erasure of personal data, or restriction of processing, or to object to such processing.
You have the right to complain to the Information Commissioner (ICO).
Where the personal data was not collected directly from you, any available information as to its source.
The existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for you.
What appropriate safeguards are or were in place if your data has been transferred to a third country or an international organisation?
Organisation's Responsibilities and Timelines
Organisations have specific duties when handling a DSAR. They must respond in a way that is concise, transparent, intelligible, and easily accessible, using clear and plain language. They also have a duty to facilitate the exercise of your data subject rights. If you make your request electronically, the organisation should provide the information in a commonly used electronic format, unless you request otherwise.
Generally, an organisation must provide a copy of your personal data free of charge. However, they may charge a reasonable fee or refuse the request if it is considered "manifestly unfounded or excessive". A reasonable fee may also be charged for additional copies of personal data.
One Month Can Be Extended to Three Months
The organisation should provide the requested information without undue delay and in any event within one month of receiving your request. This period can be extended by two further months if your request is complex or if you have made multiple requests. If an extension is needed, the organisation must inform you of this within one month of receiving your request, along with the reasons for the delay. If providing access involves disclosing information about another individual, the organisation is not required to disclose it unless specific conditions are met; supplying information on a redacted basis is also a possibility.
Providing Proof of Identity
While our template includes a provision for you to confirm your identity when making your request, it's important to note that this is not always strictly necessary unless the organisation has reasonable doubts about your identity. However, the ICO suggests providing proof of ID, such as a copy of a passport or driving licence, and proof of address, such as a bank statement or utility bill, to help the process.
A More Effective Request
Tips for a More Effective Request Although there's no strict requirement to narrow down your request, and you can simply ask for "any information that the employer processes about me," your request will often be more effective if you focus or limit it by referring to specific subject matter or dates. You can also ask the organisation to help facilitate your request, for example, by asking them to specify who was involved in a particular decision or matter.
Our DSAR Template
Our template allows you to include details such as:
A general request or specific matters to which your request is confined.
Suggestions for locating personal data, such as individuals who may have processed the data, or specific date ranges for emails.
Any variant spellings of your name or nicknames you are known by, as this can help with searching records, especially email records.
How to Use Our Template
Our template is designed to be straightforward and comprehensive. Fill in the bracketed sections with your specific details:
[ADDRESSEE] and their [ADDRESS].
Your [NAME OF ADDRESSEE].
Details about your relationship with the organisation (e.g., current or former employee, job applicant) and relevant dates or positions.
The scope of your request, whether it's a general request or focused on specific matters or allegations.
Suggestions for locating the personal data, including names of individuals or search parameters for emails and documents. You can also ask for information about individuals involved in specific decision-making.
Any variant expressions of your name.
An optional section to confirm your identity by enclosing a copy of your driving licence or passport.
Remember to keep a copy of your request for your records. The organisation should reply directly to you.
Download Your Free DSAR or SAR Letter Template
Make a Data Subject Access Request (DSAR) With Our Free Template
Understanding Your Right to Access Your Data Under the UK General Data Protection Regulation (UK GDPR), you have the fundamental right to obtain confirmation from an organisation as to whether or not they process personal data relating to you. If they do process your data, they must provide you with access to that data, including a copy of your data. This right is commonly referred to as a "data subject access right" (SAR or DSAR). Our free template is designed to help you exercise this right under Article 15 of the UK GDPR.
Who Can Make a DSAR?
A DSAR can be made by various individuals seeking their personal information. This includes current or former employees, workers, or contractors. It also applies to job applicants who have applied to work for an employer. Furthermore, you can use this service to request information for someone else, such as a child or a relative, provided you can supply proof of their identity and your authorisation to act on their behalf, such as a signed letter of consent or evidence of parental responsibility.
What Information Can You Request?
When an organisation responds to your DSAR, they must provide specific details beyond just a copy of your personal data. This includes:
The purposes for which your data is being processed.
The categories of personal data concerned.
The recipients or categories of recipients to whom your personal data has been or will be disclosed, particularly if they are in third countries or international organisations.
Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period.
The existence of your right to request rectification or erasure of personal data, or restriction of processing, or to object to such processing.
You have the right to complain to the Information Commissioner (ICO).
Where the personal data was not collected directly from you, any available information as to its source.
The existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for you.
What appropriate safeguards are or were in place if your data has been transferred to a third country or an international organisation?
Organisation's Responsibilities and Timelines
Organisations have specific duties when handling a DSAR. They must respond in a way that is concise, transparent, intelligible, and easily accessible, using clear and plain language. They also have a duty to facilitate the exercise of your data subject rights. If you make your request electronically, the organisation should provide the information in a commonly used electronic format, unless you request otherwise.
Generally, an organisation must provide a copy of your personal data free of charge. However, they may charge a reasonable fee or refuse the request if it is considered "manifestly unfounded or excessive". A reasonable fee may also be charged for additional copies of personal data.
One Month Can Be Extended to Three Months
The organisation should provide the requested information without undue delay and in any event within one month of receiving your request. This period can be extended by two further months if your request is complex or if you have made multiple requests. If an extension is needed, the organisation must inform you of this within one month of receiving your request, along with the reasons for the delay. If providing access involves disclosing information about another individual, the organisation is not required to disclose it unless specific conditions are met; supplying information on a redacted basis is also a possibility.
Providing Proof of Identity
While our template includes a provision for you to confirm your identity when making your request, it's important to note that this is not always strictly necessary unless the organisation has reasonable doubts about your identity. However, the ICO suggests providing proof of ID, such as a copy of a passport or driving licence, and proof of address, such as a bank statement or utility bill, to help the process.
A More Effective Request
Tips for a More Effective Request Although there's no strict requirement to narrow down your request, and you can simply ask for "any information that the employer processes about me," your request will often be more effective if you focus or limit it by referring to specific subject matter or dates. You can also ask the organisation to help facilitate your request, for example, by asking them to specify who was involved in a particular decision or matter.
Our DSAR Template
Our template allows you to include details such as:
A general request or specific matters to which your request is confined.
Suggestions for locating personal data, such as individuals who may have processed the data, or specific date ranges for emails.
Any variant spellings of your name or nicknames you are known by, as this can help with searching records, especially email records.
How to Use Our Template
Our template is designed to be straightforward and comprehensive. Fill in the bracketed sections with your specific details:
[ADDRESSEE] and their [ADDRESS].
Your [NAME OF ADDRESSEE].
Details about your relationship with the organisation (e.g., current or former employee, job applicant) and relevant dates or positions.
The scope of your request, whether it's a general request or focused on specific matters or allegations.
Suggestions for locating the personal data, including names of individuals or search parameters for emails and documents. You can also ask for information about individuals involved in specific decision-making.
Any variant expressions of your name.
An optional section to confirm your identity by enclosing a copy of your driving licence or passport.
Remember to keep a copy of your request for your records. The organisation should reply directly to you.