A DSAR is a legal right, and once an employee (current or former) asks for their data, the clock starts whether you like it or not. You have one month to respond.
Unfortunately you cannot refuse simply because the request seems tactical, awkwardly timed or clearly part of a wider dispute. The motivation behind it does not remove the obligation.
The good news is that a DSAR is far more manageable when you know what to do with it. Here are some quick tips that could help based on what we say and do with our clients.
1. Log the date it arrived
The one month deadline runs from the day you receive the request, not the day someone gets round to reading it. A request sent to a line manager’s inbox still counts. Diarise it immediately and tell your team what a DSAR looks like so one doesn’t sit unnoticed for a fortnight (we see this a lot!).
2. Clarify the scope early
You’re entitled to ask the person to clarify what they’re actually looking for, especially if you hold a large volume of their data. Done properly and promptly, this can pause the clock while you wait for their reply. It also stops you drowning in years of irrelevant emails when they only wanted their appraisal records.
3. Do not start deleting things
Once a DSAR is in, deleting or altering data to keep it out of the response is a criminal offence. If a deletion was already scheduled as part of a routine, documented process, that’s a different matter. Reacting to the request by tidying up is not.
4. Remember you can withhold some things
A DSAR gives someone their personal data but it does not give them everything. Legal advice is protected by privilege. Other people’s personal data usually needs to be redacted. Confidential references and certain management planning information can also be exempt. Knowing what to hold back is as important as knowing what to hand over.
5. Extend if you genuinely need to
If the request is complex or you’ve received several, you can extend the deadline by up to two months. You must tell the individual within the first month and explain why. This is only a safety valve, not a delay tactic to rely on by default.
You don’t need to have a big legal budget to do this well. The businesses who spot the request early, resist the urge to panic and get support in before the deadline becomes a problem rather than after are often the one’s that cope much better.
If a DSAR has landed on your desk and you’re not sure where to start, drop us a message. Getting the first few steps right saves a lot of grief later.
Ryan has helped a vast number of businesses protect and control their intellectual property as well as drafting and advising on consumer and commercial contracts.
