New guidance: ICO publishes help on handling data subject access requests

An SAR is an official, written request from an individual asking an organisation to disclose what personal data it holds on them, given under data protection laws.

The blog notes that the four top issues with SARs are:

• delays in responding;
• breakdowns in relationships (either because no-one at the organisation takes responsibility for dealing with the SAR or the response is incomplete and/or unsatisfactory);
• organisations failing to understand what individuals are asking for;
• individuals who ask for information not trusting what they are being told.

It goes on to recommend organisations should talk to those submitting SARs – especially if the organisation is going to be unable to handle the SAR or handle it in time. For example:

• tell them early if exemptions apply, with full details;
• ask them for additional details of what they are looking for so the organisation can locate it more easily;
• if the SAR is large and/or complicated, explain the information will be sent out in batches, and provide a timetable;
• use plain English that individuals can understand;
• act honestly, by keeping the organisation’s privacy policy up-to-date, accessible and easy to understand.

The blog post should be read in conjunction with the ICO’s guidances ‘Right of access’ and ‘Data sharing: a code of practice’.

Operative date

• Now

Recommendation

• Organisations should check out the blog post, and the guidances Right of access and Data sharing: a code of practice on the ico.org website.