DSAR – a Nightmare for Privacy Professionals

Under the General Data Protection Regulation (GDPR), individuals are provided with the ‘right to access’ their personal data.  To exercise this right, individuals can make a data subject access request (DSAR) of any organisation that holds their personal data, which must be responded to and fulfilled by the organisation within a defined timeframe.  

Responding to DSARs can be time-consuming and resource-intensive, however it is essential to handle them in full compliance with the GDPR, without cutting any corners.  Understanding how to compliantly process a DSAR can be extremely complex, as the Regulation includes a number of requirements around how they must be responded to and fulfilled, such as needing to be handled fairly and independently.  There is also the long list of derogations (exemptions or limitations to the rights of a data subject to access their personal data) to consider, which need to be applied in certain circumstances.  

In this webinar, URM will draw upon its extensive experience assisting organisations across various sectors respond to DSARs in a full compliance with the GDPR. Topics we will address include:

• What constitutes a DSAR and the legal requirements when responding to one
• The key steps you need to take in responding to a DSAR
• How to appropriately consider context
• What you can do if you believe the request is vexatious
• What are derogations and how do you consider and apply them
• How do you consider redacting other personal data (i.e., not that of the data subject)
• Potential post-disclosure issues
• Case studies of ICO enforcement action relating to failures around DSARs
• Common failings we see in DSAR responses.