Under the Data Protection Act (‘DPA’ or the Act), individuals (called ‘data subjects’) whose personal data are being processed by third parties (‘data controllers’) have the right to access and be informed about the processing of that information and to make a complaint to the data controller or the Information Commissioner if their personal data is not being processed in keeping with standards prescribed by the DPA.

Data controllers must therefore be able to effectively manage data subject access requests (DSARs) as well as their complaints.