Blog Article | AWG Consultancy

Subject Access Requests give individuals the right to know what personal data you hold about them. Handling SARs efficiently is both a legal requirement and an opportunity to demonstrate good data governance.

Understanding the Right

Under GDPR, individuals can request confirmation of whether you process their data and, if so, access to that data along with supplementary information. You must respond within one month, which can be extended by two months for complex requests.

Receiving and Validating Requests

SARs can be made in any form—there's no required format. Train staff to recognise requests even when not explicitly labelled. Verify the requester's identity before disclosing data, but don't create unnecessary barriers.

Searching and Gathering Data

Identify all systems and locations where the individual's data might be stored. This includes email, documents, databases, backup systems, and paper files. Maintain data inventories to streamline this process.

Reviewing and Redacting

Before disclosure, review all data for third-party information that shouldn't be shared. Redact information about other individuals unless they've consented or disclosure is reasonable. Consider legal privilege and ongoing investigations.

Preparing the Response

Provide the data in a commonly used electronic format if requested. Include supplementary information: processing purposes, data categories, recipients, retention periods, and rights information. Explain any exemptions applied.

Managing High Volumes

Organisations receiving many SARs should consider automation tools. Templates and checklists ensure consistency. Track requests centrally to meet deadlines. Consider whether manifestly unfounded or excessive requests can be refused or charged for.

Learning from SARs

SARs provide insight into your data practices. Difficulties in responding may indicate data governance issues. Use the experience to improve data management and reduce future effort.