Definition · Employment law and regulation
Data Subject Access Request
Definition
A data subject access request (DSAR) is a request from an individual, such as an employee or job candidate, to see the personal data an organization holds about them. Under GDPR the organization must usually respond within one month. California employees and applicants have a similar right to know under the CCPA, with a 45-day deadline.
Also called: DSAR, Subject access request, SAR, Employee DSAR, Candidate data request, Right to know request
What the person is entitled to
Under Article 15 of the GDPR (and the UK GDPR), the person can get confirmation that their data is being processed, a copy of it, and information about why it is processed, who receives it, how long it is kept, where it came from and whether automated decision-making is used. The first copy is normally free.
In HR, that can mean a lot: the application and CV, interview notes and scorecards, assessment results, emails and chat messages that mention the person, performance reviews, disciplinary records, payroll data and CCTV footage. Interview notes are the item recruiting teams most often forget, and candidates increasingly ask for them after a rejection. See GDPR in recruitment for the wider rules.
Deadlines and exemptions
Under GDPR, respond without undue delay and within one month of receiving the request. The deadline can be extended by two further months for complex or numerous requests, if you tell the person within the first month. You can verify identity before responding, and you may refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive.
You do not have to disclose other people's personal data without their consent (redact names of colleagues and witnesses where appropriate), legally privileged material, or information covered by specific exemptions in national law, such as some management forecasting data in the UK.
In the US, California extended CCPA rights to employees and applicants from January 1, 2023. Businesses must respond to a CCPA request to know within 45 days, extendable once by another 45 days with notice. Other state privacy laws mostly exclude employee data. Rules vary by country and state.
Why DSARs matter in employee relations
Many DSARs arrive in the middle of a dispute: after a dismissal, during a grievance, or before a tribunal claim. The employee's lawyer may use the request to get documents early. That makes a clean response doubly important: miss the deadline and you hand over a regulatory complaint on top of the dispute.
The practical burden is searching email and chat. A single long-serving employee can appear in tens of thousands of messages. Organizations that handle DSARs well keep HR data in defined systems, apply candidate data retention schedules so old data is actually deleted, and use e-discovery tools to search and redact.
How to respond
- Log the request the day it arrives, including requests made verbally or to a manager.
- Confirm identity and clarify scope if the request is unclear (this does not pause the clock under GDPR unless you genuinely need the clarification to proceed).
- Search every system: ATS, HRIS, payroll, email, chat, shared drives, call recordings.
- Review and redact third-party data and privileged material.
- Send the data with the required supporting information in a secure, commonly used format.
- Keep a record of what was sent and when.
Frequently asked questions
What is an employee DSAR?
It is a data subject access request made by a current or former employee for a copy of the personal data their employer holds about them, including HR files, emails and messages that mention them, and payroll records.
Can a job candidate make a data subject access request?
Yes, in the EU, UK and other GDPR-style jurisdictions, and in California under the CCPA. Candidates often ask for interview notes, scores and the reasons for a rejection.
How long do you have to respond to a DSAR?
Under GDPR, one month, extendable by two further months for complex or numerous requests. Under the CCPA, 45 days, extendable once by 45 days with notice.
Do interview notes have to be disclosed in a DSAR?
Generally yes, if they contain the candidate's personal data and are held in a filing system or electronically. Write interview notes on the assumption that the candidate may read them.