How to Handle a Monitoring Data Access Request (DSAR)
DIRECT ANSWER A DSAR (data subject access request) is an employee asking what personal data your organisation holds about them - and monitoring data is squarely in scope. Under GDPR and UK GDPR you must respond within one month (extendable by two months for complex requests); under California law the window is 45 days (extendable by another 45). The request does not need any magic words - a verbal question counts. WHAT TRIGGERS A REQUEST Any clear indication the person wants to know what data is held about them: email, chat message, verbal question in a one-to-one. No form is required, and no specific legal phrase is required. What matters is that the clock starts - so the first job is a process that catches requests wherever they arrive. WHAT THE LAW REQUIRES - GDPR / UK GDPR (Article 15): confirmation of whether data is processed, a copy of the personal data, plus purposes, categories, recipients, retention periods and the person's rights. Deadline: one month, extendable by two...