Data subject access request
Also called DSAR, subject access request
A request from an individual to see the personal data an organisation holds about them, together with information about how and why it is processed.
Last reviewed
In practice
Candidates are data subjects, and a rejected applicant is entitled to ask what a company holds on them. Most employers discover their retention practices are indefensible at exactly the moment someone asks.
Response deadlines are set in statute and are short. An organisation that answers by manually searching an inbox will miss them once volumes rise, which is why the request route is worth building before it is needed.
Related rights usually travel with it: correction of inaccurate data, erasure in defined circumstances, and portability. Records legitimately retained for audit purposes may be exempt, but the reason should be stated rather than assumed.
Related
Staged reveal
Releasing a candidate’s identity to an employer at a defined point in the process, with the candidate’s consent, scoped to that employer alone.
Identity broker
A third party that holds a candidate’s identifying information and releases it to an employer only on the candidate’s explicit instruction.