DSAR as a Service

Accommodating DSARs

The GDPR requires you to respond within one month to requests from individuals about their personal data. These requests, known as DSARs, must be processed without charge.

DSARs can be a substantial administrative burden, particularly as they must all be treated individually. There are multiple challenges to address within a short timeframe:

• Recognising the receipt of a DSAR.
• Verifying the identity of the requester. Where requests are made on behalf of others, such as through a solicitor, you need to ensure the third party making the request is authorised to act on behalf of the individual.
• Assessing whether the request is valid, and what information is to be provided.
• Reviewing collected information and redacting data relating to third parties where their consent is unavailable.

DSAR as a Service

We can support you throughout this complex process with DSAR as a Service. Our team of experienced data privacy lawyers and DPOs (data protection officers) will manage the process on your behalf to ensure requests are completed in accordance with, and in the timeframe prescribed by, the GDPR. This involves:

• Reviewing and assessing the nature and validity of the DSAR;
• Verifying the individual’s identity;
• Locating the data – liaising with the appropriate person or department to acquire all the personal information relating to the individual;
• Information screening – obtaining consent from third-party individuals where their personal information is contained within the search results and, where it is unobtainable, applying redactions and exemptions;
• Formally disclosing the information to the individual;
• Documenting the facts relating to the DSAR; and
• Liaising with the relevant supervisory authority if needed.