All You Need to Know About CCPA Data Subject Access Request (DSAR) Process

Data Subject Access Request (DSAR) is a request made to a public body or private entity that holds personal data concerning an individual. The DSAR gives the person making the request access to their personal information and the ability to challenge the accuracy or fairness of their processing.

The DSAR is usually used by individuals who have suffered a personal injury, have lost a loved one, or are concerned about their rights as consumers. It can also be used by people who want to know if they are being treated fairly.

DSARs are issued by the Office of Government Information Services (OGIS) at the National Archives and Records Administration (NARA), or by another agency or organization, on behalf of an individual or organization.

A Data Subject Access Request (DSAR) may be filed with OGIS for any of the following information:

1.      A record that contains personal information about an individual;
2.       A document that contains personal information about an individual; or
3.       Any other record that could be considered personal information under federal law if it is held by a federal agency.

CCPA DSAR Process: An Overview

The CCPA DSAR process is designed to give individuals the right to request information about them as a result of a data breach.

This process is designed in accordance with current laws, regulations and best practices to ensure that information requested is accurate and complete and that individuals are informed of their rights under the Privacy Act.

Once a data subject requests access to their personal information, the controller must provide the data subject with a copy of the request and inform them of the time period within which they must respond.

The controller then has 30 days from when the request is received to respond. If no response is received within this time frame, then the controller must inform the data subject of this and provide them with further information about how to proceed if they wish to pursue a claim under the CCPA.

Once a response is received, it must be provided in writing. However, if it is not possible for the controller or any employee to provide a written response because of circumstances outside their control (for example, if they are on holiday), then an alternative means of communication such as email or audio recording can be used instead.

Report this Page