My past experience is that yes you can DSAR scorecards if you are covered by GDPR, aka you are in the EU.