Data subject access request (DSAR)
A request from a person to see the personal data an organisation holds about them, and, more broadly, any request to exercise their data protection rights.
The GDPR and UK GDPR give people the right to access their personal data, and related rights to have it corrected, deleted or exported. A request to exercise any of these is often called a DSAR, although strictly the term refers to access.
Organisations generally have one month to respond, which can be extended in some circumstances. Other laws, such as the CCPA in California, give similar rights with their own deadlines.
What a reviewer wants to see
- A clear, public way to make a request
- A named contact who handles them
- A record of each request and when it was answered