Expert advice on subject access requests

We advise clients on complex data subject access requests (SARs), including when parties use them as a litigation tactic.

This process gives individuals a right to obtain confirmation that their personal data is being processed, a copy of their personal data, and other supplementary information.

The process of subject access requests

SARs can be made verbally or in writing, and can be sent to any part of an organisation. A SAR is valid if it is submitted by any means, including via social media. They also do not have to be provided to a specific person or contact point within a company.

Businesses have a legal responsibility to identify that an individual has made a SAR and to handle it accordingly, which means companies must comply with the SAR without undue delay – at the latest within one month of receipt of the SAR, although this can be extended in some circumstances.

Complying with subject access requests

When complying with a SAR, it is important to ensure compliance with other people’s data rights also, and many redactions to material often need to be made.