As mentioned in our previous
GDPR update, the eighth update in this series will deal with
the topic of mandatory breach notifications from an employment law
perspective and the right of data subjects (eg, prospective,
current employees and past employees) to make a data subject access
request ("DSAR") to data controllers
(eg, employers) under the GDPR.
Every data subject can request that their employer provide them
with a copy of all the personal data held by the employer about
them. This right has existed for some time but the GDPR introduces
several changes. From 25 May 2018, the number of days an employer
has to comply with a DSAR will be reduced from 40 days down to one
month. Therefore, it is imperative that, once an employer receives
a DSAR, they deal with it immediately. This is because employers
will likely have to review large volumes of information in order to
identify all of the data subject's personal data. In addition,
third party data will often need
