Beginner’s Guide to Data Protection

What is a subject access request?

You have the right to ask an organisation or company how they are using or storing your personal information. It might be done both verbally and in writing.

This is called the right of access and is commonly known as making a subject access request, or SAR.

Step one: Choose a data protection lead

Data protection must be supervised by a responsible person. That’s why you should find a person to lead data protection and handle SARs. If you are dealing as a sole band, you are responsible for dealing with these matters.

Step two: Know who you’re dealing with

It’s crucial to confirm that the SAR comes from the subject of the information request. For these purposes, you may ask some questions that only they would know, or you can ask for an ID that you can actually verify. If the request is made by another person, you need to ask for some document to prove that the person is entitled to do so.

Step three: Remember your time limits

You have a month to resolve SAR. You should:

• Respond to requests within a month, adjusting for weekends and holidays;
• Respond on the next working day if the due date falls on a non-working day.

No extra days are allowed for shorter months. For example, a request received on January 31 should be answered by February 28.

If the request is complex, you can take an extra two months to respond.

Step four: Redacting information and considering the impact of data disclosure on individuals

You should always review the information you provide for SAR. It might have an impact on third parties, so you should redact any irrelevant details. Alternatively, you may avoid such details and share only information about the requester.

Step Five: Prepare and send your reply

You should reply in the same way as you received it, unless the requester has said otherwise. Also, you need to send your personal information about processing the requester’s information and keep dated records of the information you sent in case of unhappy with your response or make another request soon after.