Data subject access requests (DSARs) are a powerful tool for individuals to understand what kind, and how much, personal data organisations hold about them. The law is on the data subject’s side and the controller has few options to limit their requests. DSARs should not be ignored.

This article explores how the right to access can be honoured in practice when the DSAR has come out of a conflict between the data subject and the controller. In these situations, the request represents one part of the relationship between the person and the organisation, and the first response is unlikely to suffice. The DPO can expect to have multiple queries and follow-ups from the requester in a case of conflict. Data Protection Officers (DPOs) may struggle to understand the context of the DSAR, the data subject’s concerns, and find reconciliation while remaining independent.(1)