Subject Access Requests

Subject Access Requests (or “SARs”) are an increasing feature of the employment landscape.

Significantly more prevalent following the introduction of, and publicity given to, the General Data Protection Regulation (GDPR), they are often part of an employee’s armoury where a dispute or potential dispute has been identified by them.

Potentially covering lengthy periods of time and significant quantities of data, both electronic and paper, a SAR can often be difficult to deal with. Add to this a lack of clarity from the ICO and an absence of judicial guidance relative to what a holder of data actually has to do to respond to a SAR, employers can be faced with significant pressure on resources, expense and complexity as they seek to comply.

Based on our extensive experience of helping clients deal with both SARs and dealing with the ICO, together with the superb sifting capabilities of our intelligent SAR review platform, we are ideally placed to help employers respond to SARs proportionately, efficiently and cost effectively.

How can we help?

Review the original SAR

The document identified as a SAR may not be clear relative to the data actually sought by the employee. We can advise on its content and any appropriate limitations which can be applied in terms of its scope. We can recommend whether there should be dialogue with the requester with a view to narrowing the scope of the request and what approach that dialogue should take.

Do we need to comply with SAR - or not?

It is not always the case that a SAR needs to be complied with. The rules permit holders of data to decline to comply in certain circumstances such as where the request could be described as unfounded or excessive. We can assist in advising on exceptions to compliance, drawing on our experience of dealing with many SARs over the years and an awareness of the ICO’s approach to these.

The compliance stage - Timeframes

You will be aware of the one-month period for responding to a SAR but there may be an opportunity for more time. We can assist in advising on applicable timescales and the entitlement or otherwise to request an extension to these.

Compliance - Structure of searches and management of what you find

It is at the point of compliance that the most challenging issues can arise. What do you do if the necessary search parameters result in thousands, tens of thousands or even, on occasions, hundreds of thousands of documents? How do you avoid the risk of disclosing other people’s confidential data or your organisation’s commercial data in error due to the complexity and volume of the documents returned by an initial search?

We can provide guidance on appropriate search parameters and we have sophisticated analytical tools to assist you to sift out irrelevant documents and duplicates, which can cut down the numbers of potentially disclosable documents by thousands, allowing easier identification of the documents that require a detailed review.

Further difficult questions can arise at the point of review of potentially disclosable documents. How do you separate out a requester’s data from the data of others? How do you separate out and determine what is privileged? How do you apply the right to withhold data that may fall into one of the relevant exemptions?

We have considerable experience of conducting SAR document reviews and advising on all of these matters. Where you have the resources to carry out a sift and review of documents internally, we can provide you with a protocol to apply to the search for, and review of documents, and we can also audit a percentage of your documents for compliance and quality control purposes.

For more information on how we can help you deal with SARs, please contact the individuals below.

Related News, Insights & Events