Expert advice on subject access requests
We advise clients on complex data subject access requests (SARs), including when parties use them as a litigation tactic.
This process gives individuals a right to obtain confirmation that their personal data is being processed, a copy of their personal data, and other supplementary information.
The process of subject access requests
SARs can be made verbally or in writing, and can be sent to any part of an organisation. A SAR is valid if it is submitted by any means, including via social media. They also do not have to be provided to a specific person or contact point within a company.
Businesses have a legal responsibility to identify that an individual has made a SAR and to handle it accordingly, which means companies must comply with the SAR without undue delay – at the latest within one month of receipt of the SAR, although this can be extended in some circumstances.
Complying with subject access requests
When complying with a SAR, it is important to ensure compliance with other people’s data rights also, and many redactions to material often need to be made.
Cybersecurity and Data
Media and Communications
"We find them excellent in terms of their tactical and strategic approach to running the case"Chambers
"They work hand in glove with you and can compete with the big firms"Chambers
"Stewarts has a go-to commercial litigation practice with strength in a number of fields"The Legal 500
Meet our Media Disputes team
Our team are experts in the media sector.
We deal with matters in the UK courts and in foreign jurisdictions, as well as in relation to complaints made to UK regulators.