A Data Subject Access Request, known as a DSAR, is a written request made by an employee to their employer for information.
All employees are allowed to request certain information from their employer and you would usually expect to see a DSAR from an employee as part of a grievance, disciplinary or employment tribunal process.
The information that employees can request from their employers are in section 7 of the Data Protection Act 1998 (DPA). DSARs usually request: confirmation about whether any personal data is being processed about them; a description of the personal data, the reasons it is being processed, and whether it will be given to any other organisations or people; copies of information comprising the data; and details of the source of the data (where this is available).
Once an employer has received a DSAR from an employee, they must respond within 40 days of receipt. The employer can charge up to £10 for dealing with the DSAR but practically, responding to the DSAR will cost much more than that for the Human Resources team to process.
If you need help to respond to a Data Subject Access Request or you need to know what constitutes ‘personal data’ within the meaning of the Data Protection Act, Altlaw can help. We can also make sure that you comply with the Freedom of Information legislation.
There are two solutions available for your SAR.
- Self-serve SAR – data can be drag-and-drop loaded into the system and you review the documents yourself. Production of documents can be undertaken by the client or with assistance from Altlaw
- Managed SAR – data can be drag-and-drop loaded into the system. Altlaw then undertakes a review and redact exercise on the clients’ behalf. Prior to the production, the client can quality check the coding decisions applied.
