What is a DSAR?
22nd July 2026 | 5 min read
Author: Hollie Graham, eDiscovery Co-ordinator
A DSAR, or Data Subject Access Request, is a request someone makes to an organisation to access the personal data held about them. In HR, DSARs often come from employees, former employees or job applicants who want to see information connected to their employment, such as HR records, emails, investigation notes or performance documents.
A DSAR is a request for personal data.
If an individual asks your organisation for a copy of the personal information you hold about them, they may be making a DSAR. They do not need to use the words “DSAR”, “data subject access request” or “UK GDPR” for the request to count.
For HR teams, this matters because personal data is rarely held in one place. It may sit in HR systems, emails, Microsoft Teams messages, manager notes, grievance files, disciplinary records, payroll systems, recruitment documents and workplace investigation material.
What does DSAR stand for?
DSAR stands for Data Subject Access Request.
The “data subject” is the person the personal data relates to. In an HR context, this could be:
- An employee
- A former employee
- A job applicant
- A contractor
- A worker
- Someone involved in a workplace investigation
The “access request” is their request to see the personal data the organisation holds about them.
When electronic disclosure is needed, the priority is to make sure data is protected and doesn’t change. In some cases, the safest option is to take a secure copy of a device or account early on, so nothing is missed or accidentally altered. Using sound, well-documented methods helps maintain confidence in the information later.
What is personal data in a DSAR?
Personal data is information that relates to an identified or identifiable person.
In HR, this can include obvious records such as an employee’s name, address, payroll details, sickness absence records, personnel file, appraisal documents and disciplinary records.
It can also include less obvious information, such as comments about an employee in emails, Teams messages between managers, handwritten meeting notes, investigation documents, call notes, spreadsheets, system records and file metadata.
This is why DSARs can become more complex than they first appear. A request may start as a simple question from an employee, but the relevant information may be spread across different people, systems and formats.
What does a DSAR look like?
A DSAR does not have to follow a set format. It can be made by email, letter, message or verbally.
Examples might include:
These requests may all amount to a DSAR, depending on the wording and context.
HR teams should be careful not to dismiss a request simply because it sounds informal. If the person is asking for access to their personal data, it should be treated seriously.
Why do employees make DSARs?
Employees and former employees make DSARs for many reasons.
Some simply want to check what information is held about them. Others may be concerned that records are inaccurate, incomplete or unfair. DSARs are also common during grievances, disciplinaries, redundancies, sickness absence disputes, whistleblowing matters, workplace investigations and employment tribunal claims.
What information can someone receive through a DSAR?
A person is generally entitled to access their personal data, but that does not mean they are entitled to every document that mentions them, this is an important distinction.
A DSAR is about personal data, not a general right to obtain all workplace documents. Some documents may contain the requester’s personal data, some may contain other people’s personal data, and some may include information that does not need to be disclosed.
For example, an email thread about an employee may include their personal data. It may also include comments about other employees, confidential business information or legal advice. That material may need to be reviewed carefully before any response is provided.
This is one reason DSARs can create practical challenges for HR teams. The question is not just “Where is the information?” It is also “What part of this information is the requester’s personal data, and can it safely be disclosed?”
Is there a deadline for responding to a DSAR?
In most cases, an organisation must respond to a DSAR within one month.
The time limit can sometimes be extended where a request is complex or where the individual has made multiple requests, but this should not be assumed. The organisation should consider the request carefully and keep a clear record of its decisions.
For HR teams, the key point is that a DSAR should be recognised early. Even where the request seems simple, finding and reviewing the relevant data can take time.
Final thoughts
Understanding what a DSAR is helps HR and legal teams respond with more confidence. It also helps you recognise when a request may need input from legal, IT, data protection or external data specialists.
A DSAR is not just a document request, it is a request for personal data, and it should be handled with care from the outset.
For support with DSAR-related data searches, employee investigations or managing digital evidence in HR matters, contact us and our experts can help.
