Dealing with a SAR
Unlock This Video Now for FREE
This video is normally available to paying customers.
You may unlock this video for FREE. Enter your email address for instant access AND to receive ongoing updates and special discounts related to this topic.
All individuals have the right to ask for confirmation that you're processing their data and for a copy of that personal data, along with supplementary information. It's also important to make sure that you know how to recognize a request and if you receive one to report it to the right department responsible straight away. You may receive a request over the telephone or the individual may make the request in person. It may be an email, a letter, a message or a post on social media. They don't have to mention the words, "Subject access request." They might just ask for copies of their personal data. However they word it, if it's clear that they're asking for their own personal data, make a note of the full name of the individual. If possible ask for another piece of information about them that you hold. Maybe an email address or a postcode that will confirm their identity and make a note of the time and the date and report it to the relevant person immediately. Organisations have one calendar month to respond to a Subject Access Request. In most cases, a fee cannot be charged and the request cannot be refused unless it's repeated, excessive or manifestly unfounded.