Right of access and “SARs” under EU data protection law
Key points:
Data subjects have the right to (i) obtain confirmation of processing and supplementary information and (ii) access the actual personal data about them being processed. This right is exercised through subject access requests (SARs). Data subjects can make a SAR verbally or in writing. Controllers have one month to respond to a request and cannot charge a fee in most circumstances.
What is the right to access and why is it important?
The right of access (a.k.a. ‘subject access’), gives individuals the right to obtain a copy of personal data about them as well as other supplementary information. It enables individuals to understand how and why data about them is used and to check whether the processing is lawful. The right of access is granted in Articles 15 of the General Data Protection Directive (GDPR).
Data subjects have a right to:
- Confirmation and supplementary information: Data subjects have a right to obtain confirmation of whether data about them is being process and, where that is the case, have access to supplementary information (which largely corresponds to the information that should be provided in a privacy notice). The supplementary information includes access to: (a) the purposes of the…
