What is the general response time for a DSAR?
Organisations should identify and acknowledge a DSAR promptly. Under UK data protection law, the substantive response must generally be provided without undue delay and within one calendar month of receiving the request. For complex requests, or where an individual has made several requests, the deadline may be extended by up to two further months.
Are there any exemptions that can be applied to a DSAR?
Yes. Although individuals have a broad right of access to their personal data, there are exemptions that allow an organisation to withhold some or all of the requested information in specific circumstances, such as legal professional privilege, management forecasting and planning, negotiations with the data subject and confidential references. These exemptions apply only to the specific information they cover and must be assessed on a case-by-case basis. Separately, an organisation may refuse to act on a request where it is manifestly unfounded or manifestly excessive, for example if it is repetitive or made with clear intent to cause disruption.
Do people have to submit a DSAR in a specific format?
No. There are no formal requirements for what a DSAR needs to look like , and it doesn’t need to mention “DSAR”, “subject access” or “GDPR” to count as one. A DSAR can be made in writing (letter, email or via social media), verbally (in person, over the phone, or in another format such as sign language), or by a third party acting on the individual’s behalf, such as a solicitor or relative. The key thing is that the person is asking for their personal information – this is what classes the request as a subject access request, not the format in which the request is made.