This help guide will show you how the HR system can help you manage Subject Access Requests (SAR or also known as DSAR - Data subject access request).

Contents

• Introduction
• To make a SAR
• To prepare the SAR response
• To view and respond to a SAR

Introduction

• Individuals have the right to ask an organisation if it's using or storing their personal information. They can also ask for copies of their personal information
• This is called the right of access and is also known as making a subject access request, a SAR or DSAR
• An employee can make this request in the HR system and specify what information it is that they wish to gain access to

Note: User roles will need access to the following pages to use this feature: Subject Access Request - all users Subject Access Request Response - HR users

To make a SAR

• Go to the following area:
  • Latest (left-hand) menu: Personal > Subject Access Request
  • Pre-2025 (top) menu: Personal Data > Subject Access Request
• The screen will display whether the employee has or has not already made a request

• Click Create Subject Access Request
• Enter the reason for the request (limited to 100 characters)

• Click Confirm
• A confirmation of the request will be presented and an email sent to a pre-configured email address

• The page will update to show there is a pending request

To prepare the SAR response

• The Data Protection report can be used to assist with collating information for the SAR response
• Go to Reporting/Reports > Reports > Data Protection Group
• Click on the Data Protection report to run it

• The report has an employee search filter so you can select the relevant subset and find the person who made the SAR

• Click on the relevant name and then Continue
• The report will download as PDF and contain a breakdown of each area where data is held in the system

To view and respond to a SAR

• Go to the following area:
  • Latest (left-hand) menu: Data Management > Subject Access Request Response
  • Pre-2025 (top) menu: People Admin > Tasks > Subject Access Request Response
• The screen will display the requests that have been made and provides the ability to Upload Document where the Data Protection report, plus any other relevant information can be uploaded for the relevant employee (this would need to be combined into one PDF)

• Once the HR user uploads the document then the request will disappear from the list, and an email will be sent to the requestor to advise that the document is now available to them

• The employee can access and download the document by returning to the Subject Access Request page