As we have already seen, a data subject has the right to request the personal information held about them by a data controller. These requests are known as DSARs, and the GDPR states that they enable the data subject “to be aware of, and verify, the lawfulness of the processing”.125

In making a DSAR, an individual is exercising their right to obtain confirmation that their data is being processed by the data controller, and to have access to that personal data and any other supplementary information to help explain the data revealed to that individual.

The right to access personal information allows data subjects access to additional information, within a timeframe of just one month, and includes specific information ...

Get EU General Data Protection Regulation (GDPR), third edition - An Implementation and Compliance Guide now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.