Essential Guidance for Handling Subject Access Requests (SARs)

What is a subject access request?

You have the right to ask an organization or company how they are using or storing your personal information. It might be done both verbally and in writing.

This is called the right of access and is commonly known as making a subject access request or SAR.

Step one: Choose a data protection lead

The data protection must be supervised by a responsible person. That’s why you should find a person to lead data protection and handle SARs. If you are dealing as a sole band, you are responsible for dealing with these matters.

Step two: Know who you’re dealing with

It is important to be sure that the SAR is made by the person about whom information is requested. For these purposes, you may ask some questions that only they would know or you can ask for ID that you can actually verify. If the request is made by another person the data is about, you need to ask for some document to prove that the person is entitled to do so.

Step three: Remember your time limits

You have a month to resolve SAR. You should:

• Respond to requests within a month, adjusting for weekends and holidays;
• Respond on the next working day if the due date falls on a non-working day.

No extra days are allowed for shorter months. For example, a request received on January 31 should be answered by February 28.

If the request is complex, you can take an extra two months to respond.

Redacting Information and Assessing Data Disclosure Impact

You should always review the information you provide for SAR. It might have an impact on third persons, so you should redact any irrelevant details. Alternatively, you may avoid such details and share only information about the requester.

Step Five: prepare and send your reply

You should reply in the same way as you receive it unless the requester has said otherwise. Also, you need to send your personal information about processing the requester information and keep dated records of the information you sent in case of unhappy with your response or make another request soon after.