Employers should be sure of their obligations if an employee
makes a data subject access request (DSAR).
Under Article 15 of the General Data Protection Regulation
(GDPR), individuals have the right to request a copy of any of
their personal data processed by their employer (the
"controller") – commonly referred to as making a
data subject access request (DSAR). DSARs made to employers are
increasingly common, especially when used as a precursor to
litigation or negotiating an exit package.
The Data Protection Commission (the Irish supervisory authority
for the GDPR) has recently published some helpful FAQs on how an
employer is obliged to respond to a DSAR. Although this is guidance
and has been issued by the Irish supervisory authority, it follows
the principles of the GDPR so should prove useful to controllers
across all EU jurisdictions.
