Definition
Data subject access request
Also called DSAR, subject access request
A request from an individual to see the personal data an organisation holds about them, together with information about how and why it is processed.
Last reviewed
In practice
Candidates are data subjects, and a rejected applicant is entitled to ask what a company holds on them. Most employers discover their retention practices are indefensible at exactly the moment someone asks.
Response deadlines are set in statute and are short. An organisation that answers by manually searching an inbox will miss them once volumes rise, which is why the request route is worth building before it is needed.
Related rights usually travel with it: correction of inaccurate data, erasure in defined circumstances, and portability. Records legitimately retained for audit purposes may be exempt, but the reason should be stated rather than assumed.
Related
Staged reveal
Releasing a candidate’s identity to an employer at a defined point in the process, with the candidate’s consent, scoped to that employer alone.
Identity broker
A third party that holds a candidate’s identifying information and releases it to an employer only on the candidate’s explicit instruction.
Read further
Longer pieces on this and the arguments around it.
GDPR and candidate data: what recruiting teams get wrong
Consent is usually the wrong lawful basis for recruitment. What to rely on instead, how long to keep applications, and the rules on automated decisions.
ReadUAE PDPL and candidate data: what recruiters in the Emirates need to know
The UAE has a federal data protection law plus separate free-zone regimes. Which applies to your hiring, and what changes about handling candidate data.
Read