DSARs: How to understand your obligations beyond data

UK and EU courts are increasingly saying that it’s not enough to point to a privacy notice to satisfy the extra GDPR requirements.

What matters

Controllers should understand when they have to disclose individual recipients of data, extra requirements for complex technical data, and explanations of automated decision-making, to know when they can rely on a privacy notice alone.

What matters next

Organizations can get ahead by updating privacy notices and processing records,

Free Trial

Register for free to keep reading.

To continue reading this article and unlock full access to GRIP, register now. You’ll enjoy free access to all content until our subscription service launches in early 2026.

  • Unlimited access to industry insights
  • Stay on top of key rules and regulatory changes with our Rules Navigator
  • Ad-free experience with no distractions
  • Regular podcasts from trusted external experts
  • Fresh compliance and regulatory content every day
Register for free Already a member? Sign in