Personal Information Request - Subject Access Request (SAR)

A Subject Access Request (SAR) is when a contact, such as an applicant, vendor or landlord, asks for a copy of the personal information you hold about them. You can produce it from their contact record as a .pdf, using the Personal Information Request option.

The .pdf includes all the information the person has given you, and any information you've added since. As the data controller, you decide how to hand it over.

Enabling user permissions for the Personal Information Request

Only users with the PersonalInformationRequest permission can produce a Personal Information Request, so you control who can export a contact's personal data. Anyone with the Group Administrator role has this permission automatically. To give it to other users:

1. Click Tools (the cog) on the main navigation bar
2. In the dropdown menu, click Templates and admin
3. On the side menu, under System Tools, click System Administration
4. Click Group Roles
5. Click Edit next to the relevant group
6. Give Full access to the permission called PersonalInformationRequest
7. Select the appropriate user(s)
8. Click Save

Producing a Subject Access Request .pdf

Produce the .pdf from the Docs menu on the contact record, then give it to the person who asked for it.

1. Click Contacts on the main navigation bar
2. Select the relevant contact from Recent & Favourite Contacts
   1. Alternatively, find the contact using the Search Contacts bar in the top right
3. Click Docs
4. In the dropdown menu, click Personal Information Request
   1. If there are 2 people on the contact record, you'll have the option to select which contact
5. Click Subject Access Request
6. Click OK
7. The Subject Access Request window opens. Click Download
   1. The information is presented as a .pdf in a browser window, ready to give to the person who requested it

An entry then appears on the contact's Timeline, recording that a Subject Access Request was produced:

Click View on the Timeline entry to see the .pdf as it was when it was created.

FAQs

• What's the difference between a Subject Access Request and a Data Portability Request?

A Subject Access Request gives the person a readable .pdf of everything you hold about them, including information you've added. A Data Portability Request gives them the information they provided to you as a .csv file, so they can move it to another system. See Personal Information Request - Data Portability Request.

• Related Help Centre articles that you may find useful.

  Personal Information Request - Data Portability Request

  Deleting an individual contact's personal data (GDPR right to erasure)

  Bulk data deletion