Understanding Subject Access Requests (SARs)
Individual Rights and SARs
Right to Request: Every individual has the right to confirm data processing and obtain copies of their personal data, including supplementary information.
Recognition and Reporting
Recognition: It's crucial to identify SARs promptly and report them to the appropriate department without delay.
Forms of Request
SARs can come in various forms:
- Telephone calls
- In-person requests
- Emails
- Letters
- Social media messages
Recognition Criteria
Identification: SARs may not explicitly mention "Subject Access Request" but must clearly indicate a request for personal data. Record the individual's full name and, if possible, another identifying detail like email or postcode.
Timely Reporting
Procedure: Note the time, date, and details of the SAR, then report it promptly to the relevant authority within your organization.
Response Time and Conditions
Deadline: Organisations have one calendar month to respond to SARs.
Charges and Refusals: In most cases, no fee can be charged, and requests cannot be refused unless they are repeated, excessive, or manifestly unfounded.