Data subject access requests are a cornerstone of the data protection regime, being fundamental in helping individuals to exercise their rights. If individuals do not know what information an organization has about them then how can they understand if their information is being used lawfully? While DSARs have been around for many years, the introduction of the GDPR in the EU and its equivalent legislation in the Channel Islands brought awareness of this right to the center stage, with those who had never previously thought much about data protection becoming aware of their personal rights. What is the right way to handle a DSAR?
