Subject access request (SAR)

Under Article 15 of GDPR, individuals can request confirmation that their data is being processed, access to the data, the purposes of processing, and the categories of data shared with third parties.

SARs can include identity information, emails, account data, IP logs, profiling logic, and more. Organizations must also disclose how long data is retained and the user’s rights related to that data.

Any individual, customer, employee, or third-party data subject can file a SAR. Requests can be made verbally or in writing and must be processed within one month unless extensions apply.