Case Study 3: Data Subject Access Request

Understanding a Data Subject Access Request

Case Study 3: Data Subject Access Request looks at an important right under POPIA. A data subject is anyone whose personal information is held by an organisation. A Data Subject Access Request (DSAR) is when this person asks to see the personal information an organisation has about them.

POPIA ensures individuals can find out what data is being collected, why, and how it is used or shared. This helps protect privacy and gives people control over their own information.

Key Points About a Data Subject Access Request

1. Who can make the request? Any South African citizen or resident whose personal data an organisation processes.
2. What can be requested? Copies of personal information, how it is used, who it is shared with, and how long it will be kept.
3. How to make a request? Usually in writing, but it can also be verbal. Organisations should have a clear process for receiving and handling DSARs.
4. Deadline for response: Organisations must respond within one month of receiving the request. This can be extended to two months in complex cases.
5. Costs: Generally, the organisation must provide the information free of charge, but a reasonable fee can be charged if the request is excessive or repetitive.

In Case Study 3, a learner can see how a company handled a DSAR. This shows practical steps and challenges when complying with POPIA.

First, the company verified the identity of the person making the request. This is important to prevent personal information from being disclosed to the wrong person.

Next, the organisation searched all records where the individual’s personal information might be stored. This included emails, databases, and paper files. The goal was to gather complete and accurate information.

The company then reviewed the information for any third-party data or sensitive content that cannot be shared, such as information about other people. Some information may be redacted to protect others’ privacy or company confidentiality.

Finally, the organisation sent a clear, understandable response to the data subject. The response explained what data was held, how it was used, and the person’s rights under POPIA. The company also informed the data subject about how to complain if they were not satisfied with the response.

This case study highlights why organisations need proper systems in place. Without clear processes and staff training, responding quickly and correctly to DSARs can be difficult.

For learners, Case Study 3 teaches these practical lessons:

• Always verify the identity of the person making the DSAR.
• Keep records organised and accessible for easy retrieval of personal data.
• Know what information can and cannot be shared in a response.
• Communicate clearly and professionally when responding.
• Respond within POIPIA’s official timeframes to avoid penalties.

In summary, a Data Subject Access Request is a vital tool for data protection and transparency under POPIA. Organisations that handle DSARs well build trust and demonstrate respect for privacy.

By studying Case Study 3: Data Subject Access Request, learners understand how to handle these requests properly. This knowledge is important for anyone working with personal information in South Africa.