Subject Access Request – what do you need to disclose?

121 HR Solutions recently supported a client who had received a subject access request (SAR) from a sub-contractor who they had engaged to deliver services into their business.  Yes, even a sub-contractor can submit a subject access request!

If you receive a subject access request it must be completed within a 30 day time limit and only in extreme circumstances is an extension of time likely to be permitted – usually when there is a substantial amount of data to be checked and submitted. 

When responding to a SAR it is important to determine whether the information you are reviewing specifically relates to the individual who has made the request.  For example, if a company wide email is sent and only the individual’s email address is evident but the email does not mention them then you would not be required to include that email.  However, emails that contain details of the individual by name must always be included – even if the email was not sent to the individual; for example, an email between two managers in which the individual is named.

Consideration has to be given to redacting data too.  If documents are submitted with other employees’ names or third party names, these must be redacted to maintain confidentiality and adherence to data protection legislation.  

Should you hold a large volume of personal data pertaining to the individual then you are entitled to ask the person making the request to narrow down the detail required – for example, narrowing it to a specific timeframe. 

121 HR Solutions supported the client by providing detail on what information would be expected to be provided in response to the SAR. This was done by looking carefully at each of the areas stated on the request.  The client then provided the documents and 121 HR Solutions sorted them into each area requested, filing them chronologically and creating a log by date and type of document.

The client commented that 121 HR Solutions simplified the process of responding to the SAR by being specific about what data was expected to be provided and then by taking on the creation of the document log, saving the client time and ensuring that they could focus on their business. The client commented that what was initially a stressful request was managed very simply and well within the required timescale. 

Should you receive a Subject Access Request, why not consider using 121 HR Solutions to support you in responding.  Contact us at enquiries@121hrsolutions.co.uk