Dealing With Subject Access Requests

Many businesses regard the Data Protection Act 2018 as something that merely requires a lot of form filling and the payment of fees, but there is a lot more to it than that.

The purpose of the Act is to protect a person's right to privacy with regard to the processing of their personal information. Individuals (‘data subjects’ in the terminology) have the right of access to information held about them. For example, a customer of your business has the right to contact you to request a copy of any data you hold on them so that they can check it. This is called a 'subject access request' (SAR). You are required by law to supply the information requested (once you have checked that they are who they say they are, of course). The individual making the request has the right to see data held in any form, not just that held on computer, so storing information in paper form does not avoid the responsibility.

Guidance on dealing with SARs is available from the Information Commissioner's website.

If you receive a SAR, you are required to supply not only all the information you hold on the data subject but also a description of why the information is processed, details of anyone it may be passed to or seen by, and the logic involved in any automated decisions. If you unjustifiably fail to comply with a SAR, the courts may impose a fine of up to £5,000. Any person who believes they have suffered damage and/or distress as a result of a contravention of the Act may seek compensation by applying to the High Court.

In the case of a failure to comply with a subject access request the Court may award compensation for distress alone.

The interpretation of the Court of Appeal is that ‘personal data’ has been defined in such a way that employees are only entitled to see information which is biographical ‘in a significant sense’ and which has the data subject as its focus. The mere mention of a person’s name does not entitle them to see the documents concerned. 

SARs are goverened by the General Data Protection Regulation. There is guidance on this from the ICO.

The contents of this article are intended for general information purposes only and shall not be deemed to be, or constitute legal advice. We cannot accept responsibility for any loss as a result of acts or omissions taken in respect of this article.

Latest News

Court Finds Clarity in Cloudy Cider Trade Mark Dispute
Nature of Confusion Considered in Pet Insurance Trade Mark Dispute
New Code Aims to Boost Music Streaming Licensing Transparency
Registering a Trade Mark is the Best Way to Protect Your Valuable Brand
Local Authority Pays the Price for Privacy and Data Protection Breaches
High Court Aids Professional Firm Targeted in Ransomware Cyberattack
Selling a Business? Warts and All Disclosure is Vital
Direct Marketing Company Pays Price for Relaxed Approach to Personal Data
Creators of John Lewis Dragon Advert Cleared of 'Copying' Allegation
Seen One Television Drama? You've Seen Them All - Copyright Ruling
New UK Version of GDPR Progressing Through Parliament
Fast Fashion Retailer's Founder Sees Off 'You Stole My Idea' Allegation
Design Rights - Supermarkets Battle Over 'Strikingly' Similar Gin Bottles
Passing Off - Injunction Refused in Battle Between Premium Vodka Brands
High Court Aids Company Facing $6.8 Million Ransomware Demand
The Sticky Story of Paddington Bear and the Royalty Distribution Litigation
Rock Band's Valuable Name Forms Focus of Bitter Passing Off Dispute
Registering a Trade Mark? Are You Sure No One Else Got There First?
Red Bull Wings to Victory in High Court Trade Mark Dispute
How to Limit the Damage of Commercial Data Leaks? Consult a Solicitor
Are You the Target of a Libellous Online Review? Consult a Lawyer Today
Design Rights - Inspiration is One Thing But Deliberate Copying Quite Another
Trade Union Targeted by Social Media Campaign Awarded £50,000 Damages
Christening a New Business? It's Madness Not to Seek Professional Advice
Design Rights - Tourist Hoodies and T-Shirts Lack Novelty, High Court Rules
High Court Aids Ship Designer in 'Blatant' Breach of Confidentiality Case
Internet Piracy - Gaming Giant Nintendo Granted Websites Blocking Order
Employers are Generally Entitled to Fruits of Their Employees' Creativity
Ticket Touts Cannot Justify the Unjustifiable - Landmark Court of Appeal Ruling
Is Data Centre 'White Space' Subject to Business Rates? Question Answered
Film Studios Faced by Piracy Scourge Granted Internet Blocking Orders
AI Machines May Take Over, But Not Yet - Landmark Patents Ruling
Indirect Consumer Confusion - Bourbon Supplier Wins Trade Mark Battle
Even Modest Sole Traders Can Reap the Benefits of Trade Mark Protection
Naming a New Business? Watch Out for Others' Intellectual Property Rights
Is It Acceptable to Poke Fun at a Competitor? High Court Tackles the Issue
Website Terms and Conditions Ruled Worthless in Online Gambling Test Case
UK Internet Entrepreneur Wins £75,000 Libel Damages from Overseas Website
High Court Aids Record Industry to Stamp Out Stream Ripping
High Court Contract Dispute Focuses on Online Gambling Domain Name
Inner Workings of Online Property Platforms Analysed in Shares Sale Row
Writer's Ex-Partner Wins Recognition as Co-Author of Hollywood Screenplay
Maker of 'Shapewear' Jeans Blocks 'Rip-Off' Product from the Market
Live Boxing Events Organiser Granted 'Dynamic' Internet Blocking Order
Rightmove Fails in 'Confusingly Similar' Website Complaint
Advent of Artificial Intelligence Poses Fundamental Questions in Patents Case
Mormon Church Wrests Control of 'Confusing' Domain Name
'Average Consumer' Takes Centre Stage in Beverages Trade Mark Dispute
British Gymnastics Scores 10 Out of 10 in Trade Mark Infringement Dispute
Revolutionary Garden Hose Design Too 'Obvious' for Patent Protection
Prosecco Producers Successfully Oppose 'Nosecco' Trade Mark Registration