What is a Subject Access Request (SAR)?
13 March 2023
Subject access is the right to access your own personal data held by any organization. This blog looks at how to recognise and manage incoming subject access requests.
How to recognise a subject access request
There is no prescribed format for subject access requests. They can be relatively informal, communicated verbally or by email as well as in writing. Nor is any specific wording required. It must simply communicate that the individual wants access to his or her information. They may ask to “see their records” or “see what you wrote about me”. The key point is that a subject access request is made by an individual (or on their behalf in limited circumstances) for access to records that relate to themselves.
Top tip: think about how a subject access request might be made to your organisation and train front line colleagues to recognize them, for example the HR team could be asked for information by employees or the sales team could be asked for details of previous transactions by individual customers and prospects.
What do we do with a Subject Access Request?
Send an acknowledgement so the individual knows you are working on it. If there is any doubt as to their identity, ask for proof of identity before you release any information.
You have one month in which to make a substantive reply so start collecting the information requested from around the organization, it may be held in more than one location.
Check whether any exemptions apply, the Information Commissioner’s website at www.ico.org.uk is a good place to start. Then send the information to the individual with a copy of your organisation’s privacy notice which explains how personal data is used by it. You should use the communication channel used by the individual to make the request unless you agree otherwise with them.
Top tip: it is illegal to charge individuals to exercise their data protection rights except in very limited circumstances, so don’t propose a fee or other charge.
This is a brief outline of how to identify and manage subject access requests. You may need support in responding to them in practice and we are here and ready to help, just give us a call/etc
Mandy P Webster
13 March 2023