Last week we looked at the right to be informed, and this week, we’ll be covering the second right of your data rights – the right of access. Also known as subject access, this gives people the right to obtain a copy of their personal data, as well as other supplementary information. It helps individuals to understand how and why you are using their data, and check you are doing it lawfully.

What is a Subject Access Request?

This is often in the form of a Subject Access Request or a SAR.

The SAR can be made verbally or in writing, including from social media, it’s valid as long as it’s clear that someone is asking for their own personal data.

A SAR can be made by a third party (such a relative, friend, or solicitor), as long as they can prove that they are entitled to act on behalf of the person.

How to respond to a Subject Access Request?

Any SAR must be responded to within one month, and ideally without undue delay. If there are many requests, or it’s a complex request, the time can be extended by a further two months.

First, you must be sure that the requestor is who they are, and should request ID documents promptly. The timescale for responding to the SAR doesn’t begin until you’ve received the documents.

Then you must make reasonable efforts to find and retrieve the requested data. If the request is excessive, you may charge a reasonable administrative fee, or decide to not conduct the search.

Next, you must send the copy of their data, and any other supplementary information (such as those within a privacy notice, or as part of the Right to be Informed, which will be covered next week) in the request format. Generally, this will be electronic, but must ensure that the requestor has the ability to access the provided data.

Finally, you must keep a record. It should include the date of the request, the date of your response, details of the requestor and of what information you provided.

There are some further reasons to refuse a SAR, depending on the situation.

Next week we’ll look at the right to rectification. If you want more information, or some advice on dealing with an SAR, feel free to contact us.