With the rising concerns over personal data privacy, governments and regulatory entities have introduced laws to safeguard individuals' personal information and uphold data sovereignty. In many countries, including the European Union and the United States, individuals have the right to request access to their personal data and have it removed. This process is known as a DSAR.
Requesting access to your data:
To initiate the process of requesting your data, you will need to contact the organization that holds your information. This could be a company you provided information to, a social media platform, or even a government agency. Your query should be in writing, usually in the form of an email or a written notice.
You must provide the organization with some fundamental information, including your name, address, and any other facts they may have on you. This is to ensure that they identify your data correctly and provide you with the relevant information. You should also state that you are making a DSAR and what you would like to receive.
The organization has a specific timeframe to respond to your request, usually two to four weeks. During this time, they may need to request additional information from you to verify your identity. You may also need to explain why you are making the request.
Once the organization has received your request, they will need to provide you with the following information:
- A copy of your personal data
- Information about why it was gathered and how it is used
- Who else has access to your data
- How long your data will be maintained for
Deletion of your data:
The process of having your data deleted is more complex. As with requesting access to your data, you will need to contact the organization holding your data and make a request in writing. You should explain why you want your data erased and confirm that you are the individual whose data is being requested for deletion.
The organization will assess your request and, if they agree to delete your data, they will need to follow a process to ensure it is removed from all their systems and records. They may need to notify any third parties who may also hold your data that it should be deleted.
Some circumstances apply to the right to erasure. Data must not be deleted if:
- It is required to fulfill a promise to you
- It is required to fulfill a legal or regulatory requirement
- It is necessary for the purposes of national security
- It is necessary for the upkeep of justice
If an organization refuses to comply with a DSAR or a request for erasure, you can dispute their decision. You can escalate the matter to a regulatory authority, who will investigate and potentially impose sanctions on the organization if they are found to be in breach of the law.
Requesting access to and having your data deleted can be a multifaceted process. However, it is an important step in taking control of your personal data and ensuring that your interests are protected.