make your free data subject access request (dsar)
what we'll cover
what is a data subject access request?
under the data protection act 2018, you can make a data subject access request (known as 'dsar' or 'sar') to organisations that hold your personal data. subject access requests can be used to find out things like:
-
details of the personal data that is being processed (ie a copy of the data)
-
the reasons why this data is being processed
-
how this data was sourced (if available)
-
which other organisations or individuals have access to your data
when should i use a data subject access request?
use this data subject access request:
-
to request access to your personal data that is held by a business or other organisation
-
if you are based in england, wales or scotland
-
if the business or organisation is also based in england, wales or scotland
sample data subject access request (dsar)
the terms in your document will update based on the information you provide
to whom it may concern,
re: subject access request
under the uk general data protection regulation (gdpr) and data protection act 2018 i have the right to request access to my personal data held by. this includes:
the right to obtain confirmation that you process my personal data.
the right to receive certain information about the processing of my personal data.
the right to obtain a copy of my personal data processed by you.
i am requesting that you supply me with the personal data you hold about me. specifically, i am requesting personal data held:
please find below my information which you can use to identify me and the personal data i am requesting access to, to respond to my request and to keep a record of my request and your response.
- full name:
- address: , ,
- date of birth:
- telephone number:
- email address:
- are you a current or former employee of?: i am a employee
- approximate date of employment:
if you need any more information, please let me know as soon as possible.
please provide the personal data requested in.
please bear in mind that data protection laws require you to respond to my request for personal data within one calendar month.
if you do not normally deal with data subject requests, please pass this letter on to your data protection officer or relevant member of staff.
yours faithfully,
_________________________________ | _________________________________ |
about data subject access requests (dsars)
learn more about making your data subject access request (dsar)
-
how to make a data subject access request (dsar)
making a data subject access request online is simple. just answer a few questions and 2022世界杯32强抽签时间 will build your document for you. when you have all of the details prepared in advance, making your document is a quick and easy process.
to make your dsar you will need the following information:
party details
-
the details of the business or organisation that you’re sending the dsar to (including its legal structure, name and address).
-
your details (including your name (and any previous names), address, date of birth and contact details).
personal data
-
where is the personal data you are requesting access to held? in employment records or personnel files; in pension or benefits records; by a specific department; in billing records; in user activity logs; in medical records; in financial statements; or in another place?
-
if the data is held by a specific department, what is the department’s name?
-
if the data is held in medical records, what are the doctor’s and practice’s names? what are the dates of the medical records being requested?
-
if the data is held in financial statements, what account number do they relate to and what are the dates of the financial statements being requested?
-
if the data is held in another place, where is it being held?
-
employment
-
are you a current or former employee of the business or organisation holding your personal data?
-
if you are a current employee, when did you start working for the business or organisation?
-
if you are a former employee, when did you start and stop working for the business or organisation?
-
provision of personal data
-
should the requested personal data be provided in electronic and/or hard copy?
letter
-
on what date is the dsar sent to the business or organisation?
-
-
common terms in a data subject access request (dsar)
data subject access requests are used by data subjects (ie individuals) to request a copy of their personal data held by a business or other organisation. as a result, dsars will typically include:
an introduction
this sets out your right under the data protection act 2018 and uk general data protection regulation (gdpr) to make a dsar and what exactly this entails.
details of the personal data requested
this sets out your request that the business or organisation supplies you with the personal data it holds about you. it then provides details of where the requested personal data is held.
details to identify the data subject
this sets out details that can be used by the business or organisation to identify you and the personal data you are requesting access to. these details include:
-
your name and any previous or other names you are or have been known by
-
your address
-
your date of birth
-
your telephone number and email address
-
if applicable, whether you are a current or former employee of the business or organisation, and your employment start (and, where applicable, end) date
response to your dsar
this sets out how you wish to receive a copy of the requested personal data. it also reiterates that, under data protection laws, a business or organisation generally has one calendar month to respond to your letter.
if you want your dsar to include further or more detailed provisions, you can edit your document. however, if you do this, you may want a lawyer to review or change the dsar for you, to make sure it complies with all relevant laws and meets your specific needs. ask a lawyer for assistance.
-
-
legal tips for making a data subject access request (dsar)
understand when it’s appropriate to make a dsar
data protection laws give data subjects the ‘right to access’, which grants them the right to request and receive a copy of their personal data. empowering individuals to make such data subject access requests allows them to understand how and why businesses and other organisations are using their data. it also helps individuals verify that any use of their data is lawful.
generally, someone can only make a dsar on their own behalf (ie you can send a request to a business to find out what data they hold on you). however, dsars can also be made on behalf of another, provided that the individual making the request has the authority to do so. this may be the case if a parent with parental responsibility requests information on behalf of their child, or if someone makes a dsar under a power of attorney.
for more information, read making subject access requests.
remember that you may not always get access to all personal data requested
while businesses or organisations will typically tell you whether they process your personal data and, if they do, provide copies of it, they may not always provide all data you request. depending on your situation and circumstances, you may only receive some of the data requested or you may receive no data at all. examples of situations in which you might not receive (all) personal data requested in a dsar include:
-
if the information requested is not actually covered by dsars (eg you asked for a deceased relative’s medical records)
-
if an exemption applies (eg it would prejudice ongoing negotiations)
you should also be aware that a business or organisation may refuse to comply with a dsar if they believe the request is ‘manifestly unfounded or excessive’ (eg if they believe that you don’t have a genuine intention of accessing the information). if this is the case, they should provide you with their reasoning as to why this is the case.
be aware that you may have to provide proof of identity
after a dsar is made and sent, the business or organisation may ask you for proof of id to carry out identity verification for security reasons.
where you are asked to provide proof of your identity, the one-month time limit within which the business or organisation has to respond is extended. in fact, the time limit does not start until the business or organisation has received your proof of id.
for more information, read data protection requests.
be aware that a fee may be charged in some circumstances
generally speaking, businesses or other organisations should comply with and respond to dsars free of charge. however, a fee may be charged by the business or organisation if:
-
you ask for additional copies of the data requested
-
the business or organisation believes your request to be manifestly unfounded or excessive. in this case, a fee can be charged to cover their administrative costs
the one-month time limit for responding to a dsar doesn’t start until after any required fee is paid and received.
for more information, read data protection requests.
understand when to seek advice from a lawyer
ask a lawyer for advice if:
-
you are making a subject access request on behalf of someone else
-
this document does not cover your legal needs
-
the business is based outside of england, wales and scotland
-
a business does not respond to your request
-
data subject access request (dsar) faqs
-
what is included in a data subject access request?
this subject access request template covers:
-
your details
-
the organisation’s (eg business’) details
-
details of your rights relating to personal data
-
where the personal data you are requesting access to is held (eg in employment records, billing records or user activity logs)
-
how the personal data should be provided to you
-
-
what details does a data subject access request need to include?
your sar should, as a minimum, include:
-
your full name (including any previous names, if relevant)
-
your up-to-date contact details (eg address and telephone number)
-
details of the specific information you require and any relevant dates
-
how you would like to receive the information (eg by email or in print)
a sar should not include information not relevant to your request (eg a wider customer service complaint).
while you may request all the information an organisation holds on you, bear in mind that organisations may hold a lot of information. requesting access to all of it could mean that the organisation takes longer to respond and it may make it more difficult for you to locate the specific information you need in their response.
for more information, read making subject access requests.
-
-
how long does a business have to respond to a dsar?
businesses generally have one month to respond to your request. they may, however, need extra time to consider your request in some circumstances (eg if you have made several requests or where proof of id is required). where this is the case, they can take up to an extra two months to respond. in this case, they must inform you within one month that they need more time and explain why.
for more information, read data protection requests.
-
how will a business respond to a data subject access request?
a business will generally tell you whether or not they process your personal information and, if they do, provide copies of it. they should also set out other details, including:
-
what they use your information for
-
who they share your information with
-
how long they’ll store your information for and how this was decided
-
where they obtained your information from
-
if they use your information for profiling or automated decision-making and, if so, how this is done
bear in mind that you may not always receive all the information you have requested.
for more information, read making subject access requests and data protection requests.
-
-
what if a business doesn’t respond to my dsar?
if a business doesn’t respond or you are dissatisfied with their response, you should contact the organisation. if you do not receive a response or remain dissatisfied with the response, you can complain to the information commissioner’s office (ico). for more information, read data protection requests.
our quality guarantee
we guarantee our service is safe and secure, and that properly signed 2022世界杯32强抽签时间 documents are legally enforceable under uk laws.
need help? no problem!
ask a question for free or get affordable legal advice from our lawyer.