Want to watch this video? Sign up for the course here. Or enter your email below to watch one free video.

Unlock This Video Now for FREE

This video is normally available to paying customers.
You may unlock this video for FREE. Enter your email address for instant access AND to receive ongoing updates and special discounts related to this topic.

Individuals have the right to obtain confirmation that you are processing their data, as well as the right to a copy of the personal data you hold and any other other supplementary information. This is commonly known as a subject access request or SAR.

In the past, a data subject would have to make a request to a nominated person or department within an organisation and the SAR request would be more formal. Since recent changes to legislation have come into force, a subject access request can be made verbally or in writing to any member of staff or even by social media, and it does not have to include the phrase “Subject Access Request” as long as it is clear that the individual is requesting their own personal data.

This means that it is important to ensure that all staff know how to recognise a Subject Access Request and the process to follow when they receive one. Organisations should have a policy in place to record and deal with any access requests they receive, including a log of verbal requests or requests made in person.

The individual is only entitled to their own personal data and not to information relating to other people unless they are acting on their behalf and you have obtained proof that they have the correct permission to do so. If they do provide proof, you can if you think the individual does not understand what information would be disclosed, send the response directly to the individual rather than pass it on to the third party.

If the request relates to data held about a child, even if that child is too young to understand the implications of an S.A.R it is still the right of that child rather than that of anyone else. If you are confident that the child is mature enough to understand their rights, you should respond directly to them.

In Scotland, a person aged 12 years or over is deemed to be of sufficient age and maturity to exercise their right of access. This does not apply in England, Wales or Northern Ireland, however, it does indicate an approach that will be reasonable in many cases, so you must assess the level of understanding of the individual child.