FAQs – Data Subject Access Requests

Who is a data subject?

Any individual who may be identified from any form of document, whether directly or indirectly, is a data subject. This is a key concept used to determine what data falls under the category of 'personal data'. Data subjects have certain rights under the UK GDPR.

What is a Data Subject Access Request?

A data subject access request (DSAR) is a request made by an individual to:

• Obtain confirmation from an organisation that it is processing their personal data
• Access their personal data held by an organisation
• Receive other information concerning this data and its processing purposes

When can a DSAR be submitted?

Any data subject (the identified or identifiable living individual to whom personal data relates) has the right to make a DSAR. We see these being made frequently in the employment context, whereby an employee submits a DSAR to their past or present employer.