How to respond to a Subject Access Request?

Has someone just submitted a data subject access request to your organization? You’re likely feeling the pressure of tight deadlines and compliance requirements while trying to run your business. Whether you’ve received this request through email, social media, or a formal letter, you need to act quickly but carefully. This comprehensive guide will walk you through the essential steps to handle SARs effectively and confidently. For complex cases involving sensitive data or potential disputes, we strongly recommend seeking professional legal guidance to ensure full compliance and protection.

subject-access-request

Key Takeaway: What’s the biggest pitfall when handling Subject Access Requests?

Incomplete data searches. Organizations often focus on obvious digital records while overlooking less traditional sources like CCTV footage, messaging apps, or archived files, leading to non-compliance and potential legal consequences.

Discover how to handle Subject Access Requests correctly in our step-by-step expert guide.

What is a Data Subject Access Request?

A Data Subject Access Request (DSAR) empowers individuals to discover exactly what personal information your organization holds about them, how you use it, and who you share it with. Under UK data protection law, your obligations include:

Acknowledging the request promptly upon receipt.
Responding within the Subject Access Request time limit of one calendar month.
Providing the information free of charge in most cases.
Verifying the requester’s identity before disclosure.
Including all relevant data from digital and physical storage.
Explaining any technical terms or codes in plain language.
Documenting your handling process from receipt to response.

Good to know:

The one-month Subject Access Request timescale can be extended by two months for complex requests, but you must inform the requester within the first month. Failing to respond within the statutory timeframe could result in regulatory action and potential compensation claims.

Initial steps in processing a request

When a data subject access request lands on your desk, swift and systematic action is essential to meet your legal obligations while protecting both the requester’s and third parties’ rights.

Your immediate steps should include:

Logging the request details in your tracking system, including the receipt date.
Confirming receipt to the requester within 48 hours.
Verifying the requester’s identity using two forms of identification.
Clarifying any ambiguous points in the request without delaying the process.
Identifying all potential data sources within your organization.
Notifying relevant department heads who might hold the requested information.
Setting up a secure folder for collecting and storing the gathered information.

Tip:

Create a standardized Subject Access Request template for internal use to ensure consistent handling of all requests.

Caution:

For sensitive requests like CIFAS Data Subject Access Request or Subject Access Request home office applications, additional verification steps may be necessary.

Gathering and reviewing data

Meeting the Subject Access Request timescale requires a methodical approach to data collection and review, ensuring no personal information slips through the cracks while maintaining the privacy of other individuals.

Follow these systematic steps:

Search all relevant data storage locations: Conduct a thorough sweep across your organization’s entire digital and physical infrastructure, including databases, email systems, archives, cloud storage, mobile devices, third-party processors’ records, and surveillance systems to ensure complete data capture.
Review and prepare the data: Systematically process the collected information by separating personal data from business records, applying necessary redactions for third-party information, identifying privileged content, standardizing formats for clarity, evaluating automated processing records, and maintaining a detailed log of all search results, including null returns.

Good to know:

For an ex-employee subject access request, your search should encompass the entire employment lifecycle, from recruitment documents through to exit interviews.

Preparing and delivering the response

Understanding what is included in a subject access request response requires meticulous attention to detail and clear presentation to meet both legal obligations and the requester’s expectations.

Adopt this comprehensive approach:

Compile the response package: Present all gathered information in a clear, chronological format, accompanied by a detailed index explaining data categories, processing purposes, retention periods, and sharing practices, while ensuring technical terms are explained in plain language accessible to the requester.
Provide mandatory explanations: Include a comprehensive overview detailing your data processing activities, covering data sources, recipients of any disclosures (especially outside the EU), security measures implemented, and explanations of any automated decision-making processes that affect the individual.

Caution:

A single oversight in your search could trigger Subject Access Request 40 days breach compensation claims and regulatory scrutiny.

Common challenges and exemptions

Refusing a Subject Access Request under GDPR requires careful consideration of legal grounds and potential consequences, as improper handling could lead to regulatory penalties and reputational damage.

Navigate these challenges with confidence:

Valid grounds for refusal: Requests can be lawfully declined when they are manifestly unfounded, excessive, or would reveal third-party information that cannot be reasonably redacted, while legal professional privilege and ongoing legal proceedings may also justify specific exemptions to disclosure.
Managing special circumstances: Handle sensitive situations such as ex-employee Subject Access Request with extra diligence by separating personal data from confidential business information, addressing potential conflicts of interest, and managing requests during disputes or tribunals with particular care.

Remember:

Document all decisions to apply exemptions thoroughly, as you may need to justify these to the Information Commissioner’s Office.

Do I need a lawyer?

While straightforward SARs can be handled internally, certain scenarios warrant professional legal guidance to navigate complex compliance requirements and protect your organization’s interests.

Consider these critical situations:

When legal expertise is crucial: Seek professional support when dealing with complex multi-jurisdictional requests, sensitive data involving multiple parties, requests during active disputes, potential Subject Access Request 40 days breach compensation claims, or when handling Subject Access Request school records involving minors.
Risk mitigation benefits: Professional legal guidance provides crucial protection by ensuring compliance with latest regulations, managing complex exemptions correctly, handling subject access request time limit extensions appropriately, and safeguarding against potential future litigation.

Good to know:

Early legal consultation can often prevent costly mistakes and reduce the risk of regulatory investigations.

FAQs

How much can you charge a customer for completing a Subject Access Request under GDPR? You may charge a reasonable fee only for manifestly unfounded or excessive requests.
Can a company refuse a Subject Access Request? Yes, but ensure any refusal or partial disclosure is legally justified and clearly explained to avoid potential disputes.
Which timeframe should a Data Subject Access Request be completed? Organizations must respond to a subject access request within one calendar month of receipt. For complex cases, this can be extended by up to two months, but you must notify the requester within the initial month.

Handling Subject Access Requests effectively requires a balance of promptness, accuracy, and compliance. While the one-month timeframe may seem challenging, a systematic approach and proper documentation will ensure you meet your obligations while protecting both individual rights and organizational interests.

Struggling to navigate Subject Access Requests?

Qredible’s network of experienced data protection solicitors can guide you through every step of the SAR process, from initial response to complex data reviews and compliance management.

KEY TAKEAWAYS:

Subject Access Requests must be answered within one calendar month and require immediate action upon receipt to ensure timely compliance with data protection regulations.
Organizations must conduct comprehensive searches across all data storage locations, including digital systems, physical files, and third-party processors.
All personal information must be presented clearly, with explanations of how it’s used, while carefully protecting third-party privacy through appropriate redactions.
Valid exemptions exist for refusing requests, but these must be legally justified and clearly communicated to the requester.
Complex cases, particularly those involving ex-employees or sensitive data, often benefit from professional legal guidance to ensure full compliance.