Data Subject Access Request (DSAR)
1. Overview
Under EU and UK law, individuals have the right to know what personal data an organisation processes about them and how it is used. You can exercise this right for review and update by submitting below
The rules for DSARs are outlined in the GDPR (General Data Protection Regulation), and these have been carried over into UK data protection law with only a few exemptions, which are detailed in Section 45(4) of the DPA (Data Protection Act) 2018.
DSARs as a concept were not created with the GDPR, but the legislation standardised several processes that make it easier for individuals to submit requests and place a greater burden on organisations to complete them.
2. What are data subject access requests?
DSARs are the result of the GDPR’s right of access – one of eight data subjects enshrined in the Regulation.
3. What is included in a data subject access request?
A request might refer to specific personal details or processes for which the AB PLUS processes that information. In these cases, we only need to provide relevant information.
However, customer may ask to see a complete list of the personal data that AB PLUS stores on the customer profile.
This will undoubtedly be burdensome because it’s not merely a case of pulling up everything we store on that person.
If we did that, we’d end up with large volumes of information that aren’t considered personal data – such as internal memos about the data subject’s files – which don’t need to be shared.
Our first tasks, therefore, are to determine what information related to the individual is considered personal data under the definition of the GDPR, and whether it’s part of the data that they requested.
This information must be provided alongside other supplementary material, such as the relevant details provided in the organisation’s privacy notice.
4. Can information be redacted?
Although the GDPR promotes openness to the public, AB PLUS can and, where relevant, should redact anything that’s not within the scope of the DSAR.
For example, we might have documents that include that individual’s personal data alongside other people’s personal details.
In these circumstances, we are required to redact all personal data that isn’t about the person making the request, because otherwise we’d be committing a data breach.
Likewise, we might have records where the individual’s personal data is stored alongside sensitive company data. We are within our rights to redact that information.
5. data subject access request flowchart
We are following the steps when responding to a data subject access request. Take a look at our infographic for a handy guide on the DSAR response process:
6. Customers have to give a reason for a DSAR?
Customer don’t need to state why they are submitting a DSAR. The only questions an organisation may ask when a DSAR is submitted concern verifying the individual’s identity or helping them locate the requested information.
7. Does a request have to be in writing?
You can either to submit Update information or email to info@ab-money.co.uk for make a request or call 0203 355 9660 while speaking with a member of staff.
It’s also worth noting that individuals aren’t required to use the technical term for a request (‘DSAR’ or ‘data subject access request’).
Just simply say that you would like to see a copy of the information the AB PLUS stores the information.
That requests are most likely to be submitted in writing, as it’s the most convenient method.
It gives you and us a record of the request, the date that it was made and other relevant information, such as the specific personal information that you want a copy of and the format that it should be delivered via email.
8. Can you submit a DSAR on behalf of someone else?
Yes, you can authorise someone else to make a request on their behalf. This is most likely to happen when:
- Someone with parental responsibility asks for information about a child;
- A court-appointed individual is managing someone else’s affairs;
- A solicitor is acting on their client’s instructions; and
- The data subject requests help from a relative or friend.
Once it satisfied by our compliance that the person making the request really is doing so on behalf of the data subject.
As such, they are entitled to request supporting evidence, such as written authorisation from the data subject or a more general power of attorney.
9. How long does AB PLUS have to respond to a DSAR?
here is a subject access request time limit. DSARs must be fulfilled “without undue delay”, and at the latest within one month of receipt.
Where requests are complex or numerous, we are permitted to extend the deadline to three months. However, they must still respond to the request within a month and explain why the extension is necessary.
10. Who is responsible for responding to a subject access request?
Our support team will generally be responsible for fulfilling a DSAR on your request.
We will oversee the process and ensure that it is being completed in line with the GDPR’s requirements.
11. How much can be charged for a subject access request?
Under the GDPR’s predecessor, the DPA (Data Protection Act) 1998, organisations could charge a fee for fulfilling a DSAR, but that’s no longer the case in most instances.
AB PLUS do not charge a fees for fulfilling a DSAR for our customers.
12. What’s the difference between a freedom of information request and a DSAR?
DSARs might sound a lot like freedom of information (FOI) requests, but in practice, they are a lot different.
Whereas DSARs grant EU residents access to copies of their personal data, FOI requests are specific to the UK and relate to recorded information held in the public sector.
This generally refers to government departments, local councils and regulators, such as the Financial Conduct Authority.
Additionally, personal data is not covered by the FOI Act, so there are no restrictions on who can make a request.
13. The process for handling a DSAR
Like many aspects of the GDPR, access requests have a formal name that AB PLUS must be aware of for compliance purposes, but that doesn’t mean you need to know the terminology.
As the ICO (Information Commissioner’s Office), the UK’s data protection supervisory authority, notes, there’s no specific process for making a request, so someone could simply say “I’d like to see what data you have on me”, and that would be considered a legitimate request.
Therefore, Support Team or (Anyone) in AB PLUS who may receive such a request must know what to look out for and who to pass the message on to.
Since time is of the essence when responding to a DSAR, We have an established DSAR process beforehand, so that we can deal with such requests quickly.
14. How to ensure data subject access request success
There are many steps we can manage DSARs. Our first task is to create a flowchart to make sure we respond promptly, thoroughly and in line with the GDPR’s requirements.
There are also ways you can make our organisation more resilient to the challenges that come with responding to DSARs. For example, you should implement measures addressing: