Data subject access requests (DSAR) services
Outsourcing DSARs is the ideal solution for organisations that lack the necessary in-house knowledge, frequently handle complex DSARs or simply don’t have sufficient resources to respond.
Data subjects have the right to know that an organisation is processing their personal data and may request a copy of such personal data.
A data subject access request, sometimes referred to as a subject access request or a SAR is a request made by an individual to access the personal information that is held by an organisation.
The data subject access request will ask for some or all of the following:
An individual is only entitled to their own personal data, and not to information relating to other people (unless the information is also about them, or they are acting on behalf of someone).
The subject access request can be made verbally or in writing, including on social media.
DSARs must be fulfilled without delay and within the relevant timeline. Under some legislations, the organisation can extend the time limit by a further two months if the request is complex or if the same individual has made a number of requests.
All we do all day every day is privacy. All of our team are constantly keeping up to date with best practice and have on average two hours of relevant training a week.
We often encounter situations where exemptions can be utilised - we understand when these can be used having liaised with regulators across multiple industries.
Our experts advise on the management of the DSAR as well as the engagement with the data subject. Such support can prove invaluable in those rare occasions where there is a need to de-escalate a contentious situation.
Knowing that effective communication is critical to build trust, our specialists use plain, jargon-free language and clear explanations that strengthen customer relationships.
With our support and guidance, we mitigate the work required to satisfy the request by focusing the search efforts and confirming precisely what needs to be redacted, ensuring the response is delivered within the required timeframe. Or we can manage the redacting process from start to finish.
Our team is accustomed to handling DSARs across different regulatory regimes. We provide complete reassurance that the process follows the legislative requirements and meets the agreed response time.
Our processes are robust. Where relevant to improve the efficiency of your DSAR process, we advise on relevant e-discovery tools and other software. We can also help you implement appropriate redaction methods to avoid disclosing third-party data in DSAR responses.
We are not a law firm, but we employ lawyers. We’re not a cybersecurity business but our staff qualifications include CISSP and CISA. We’re not selling a one-size-fits-all tech product, but we’ve built proprietary tools and techniques that work with the class-leading GRC products to simplify and streamline the hardest tasks in assuring privacy.
We're corporate members of The International Association of Privacy Professionals (IAPP) which is a resource for privacy professionals globally. A not-for-profit organisation, the IAPP offers a full suite of educational and professional development services and is the leading provider of privacy certifications. All our consultants are required to obtain one or more IAPP certifications.
We’re also ISO 27001 and 27701 certified and have a comprehensive set of policies and frameworks to help our clients achieve and maintain certification. Above all, our relentless focus is on practical operational delivery of effective data privacy for all your stakeholders.
