What does a subject access request allow individuals to do?

A subject access request (SAR) primarily allows individuals to request access to their personal data held by an organization. This right is a critical component of data protection legislation, such as the General Data Protection Regulation (GDPR) and also aligned with various U.S. state data privacy laws. When an individual makes a subject access request, they can inquire about what personal data is being processed, for what purposes, and who it is shared with. This request empowers individuals by promoting transparency and enabling them to understand how their data is being used.

While options about rectification, portability, and deletion of personal data represent important rights under privacy laws, they stem from different specific requests or rights rather than the core function of a subject access request itself. The focus of a SAR is fundamentally about providing access to information held by organizations, making it a key mechanism for individuals to engage with data privacy rights effectively.