If my organisation is processing data on behalf of a controller, does the data subject have access rights through the processor, or must Subject Access Requests (SARs) go through the controller?

If the processor then becomes a controller (or joint controller) through activities that create new data about the individual, should an SAR disclose all data about said individual, or only data not passed in by the original controller?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.