Under the General Data Protection Regulation (GDPR), there’s a specific way to deal with data subject access requests. But how can you manage them effectively while remaining compliant?
Key takeaways
- People can ask for their data – GDPR gives individuals the right to access personal data through DSARs.
- Replies must be quick – Organisations have one month to respond, with up to two extra for complex cases.
- Delays can be costly – Missing deadlines or poor responses may result in fines and enforcement action.
Understanding data subject access requests
- What is a data subject access request?
- How long do you have to respond to a DSAR?
- What’s an example of a DSAR to a bank?
- Why are DSARs particularly complex for the construction industry?
- What are the consequences of failing to respond to a DSAR?
- What are data subject access request fees?
- What are manifestly unfounded and excessive DSARs?
- Data subject access requests FAQs
Companies hold individuals' personal information, and they have the right to access it. Refusing to provide it is acceptable only if an exemption or restriction applies or the request is manifestly unfounded or excessive.
What is a data subject access request?
Individuals (data subjects) have the right to access and receive a copy of their personal data and other supplementary information. This is commonly referred to as a data subject access request or 'DSAR'.
How long do you have to respond to a DSAR?
In general, companies have to respond to a DSAR without undue delay. The longest you can wait is a month from the time you receive the request. Failing to reply at all after 40 days can result in regulatory action and fines.
You can extend the time limit by a further two months if the request is complex or you’ve received multiple ones from the same individual.
What’s an example of a DSAR to a bank?
Nigel Farage claimed his bank accounts had been closed by Coutts, a private bank, because of his political views. After Farage's DSAR to Coutts, there was a raft of other DSARs to banks. Coutts responded to Farage's DSAR by providing a 40-page document. This included details of his account as well as communications between Coutts and the media about him.
This case revealed that banks keep detailed records about their customers, including information on their political views and communications with the media. The ensuing raft of other DSARs to banks put pressure on them to be more transparent about how they collect and use customer data. This also opened the door to banks coming under fire for violating people’s privacy.
Why are DSARs particularly complex for the construction industry?
DSARs are challenging for the construction industry because of its vast, dynamic, decentralised, unstructured and fragmented nature. Multiple stakeholders, frequent project turnovers, and large workforces increase the risk of data mishandling.
However, these challenges can be managed effectively through centralised data management systems, comprehensive employee training and dedicated compliance teams.
What are the consequences of failing to respond to a DSAR?
Responding to DSARs within a specific timeframe is a compliance requirement. Failing to adhere to this legal obligation could result in regulatory investigation and action – the Information Commissioner's Office (ICO) issues reprimands and fines.
A reprimand is a written notice that details key compliance issues the ICO finds and sets out breached provisions of the legislation. It also recommends how the company can improve its compliance.
Fines can be up to £17.5 million or 4% of the company's total annual worldwide turnover in the preceding financial year – whichever of the two is higher.
Furthermore, individuals who don’t have their DSARs handled correctly and experience distress can seek financial compensation. These consequences not only impact a firm financially but also damage its reputation.
Regulatory action by the ICO
The organisations listed below collected and processed personal data and then failed, on multiple occasions, to respond to DSARs either within the legal timeframe or at all. The ICO has taken regulatory action by issuing a reprimand against the following organisations:
- Ministry of Defence (MoD):
Despite having a recovery plan in place, the ICO identified a DSAR backlog dating back to March 2020 that continued to grow, with about 9,000 awaiting responses. - Virgin Media:
The ICO found Virgin Media failed to respond to 19% of 9,500 DSARs over six months in 2021. - Home Office:
The Home Office failed to respond to nearly 21,000 DSARs within the legal timeframe in 2021.
London borough of Croydon:
Croydon Council failed to respond to more than half of DSARs within the legal timeframe from April 2020 to April 2021. In numbers, this means 115 residents didn't get a response. - Kent Police:
Within five months from October 2020, Kent Police received more than 200 DSARs, with 60% completed in the legal timeframe. Regarding the remainder, some reportedly took over 18 months to complete. - London borough of Hackney:
Hackney Council failed to respond to more than 60% of DSARs within the legal timeframe from April 2020 to February 2021. The oldest outstanding one was 23 months. - London borough of Lambeth:
Lambeth Council received over 800 DSARs for the year beginning August 2020. Only 53% were responded to within a month.
What are data subject access request fees?
GDPR Article 12 (5) states that the response to a DSAR must be provided free of charge, except when the request is deemed manifestly unfounded, excessive, or repetitive in character. In that case, the data controller can levy a reasonable fee, taking into account the administrative burden associated with a response, or refuse to act on the request.
Either way, the burden of proof regarding whether the request is manifestly unfounded, excessive or repetitive lies firmly with the data controller. When choosing not to reply to a request, they must, within one month, advise the data subject why and offer the right to lodge a complaint or refer the matter to the supervisory authority.
What are manifestly unfounded and excessive DSARs?
According to the ICO, factors that may indicate a manifestly unfounded and excessive DSAR are:
- “Explicitly states, in the request itself or in other communications, that they intend to cause disruption
- “The request makes unsubstantiated or false accusations against you or specific employees which are clearly prompted by malice
- “The person is targeting a particular employee against whom they have a personal grudge
- “The person makes a request but then offers to withdraw it in return for some sort of benefit from the organisation
-
“The person systematically or frequently sends different requests to you as part of a campaign with the intention of causing disruption, eg once a week”
Data subject access requests FAQs
What exactly must be included in a DSAR response under GDPR?
Under Article 15 of the GDPR, a controller must provide confirmation of processing, access to the personal data, and supplemental information such as:
- Purposes of processing
- Types of personal data involved
- Recipients of data (including third countries)
- Retention period or criteria
- Data source (if not collected directly)
- Rights to rectification, erasure, restriction, or to object
- Right to lodge a complaint with a supervisory authority
- Automated decision-making logic and consequences
Plus, where relevant, safeguards for international transfers.
How is the one-month response deadline calculated?
Yes. Controllers should apply reasonable identity verification measures to ensure they don't disclose data to the wrong person. However, it’ is important not to request excessive or unnecessary documentation, especially formal ID, if other reasonable methods (such as email verification or an identity-proofing platform) are available.
How is the one-month response deadline calculated precisely?
GDPR mandates response "without undue delay" and within one month of the request, or from receipt of necessary information to verify identity or a valid fee. That deadline runs to the same calendar date the following month; if that date doesn't exist (for example, from January 31st), the deadline is the last day of the next month. If it falls on a weekend or holiday, apply the next working day.
When and how can the response deadline be extended?
A controller can extend the deadline by up to two months if the request is complex or the data subject has submitted multiple rights requests simultaneously (for example, access, erasure, portability). However, the extension must be issued within the initial one-month period, providing reasons for the delay.
Want to learn more about GDPR?
If you’re looking for focused training, our Data Protection and GDPR Compliance Training Hub offers a complete solution for your compliance programme. Courses include:
Our e-learning courses are designed to engage employees, including our microlearning library, which supports knowledge retention.
Our Compliance Portal also features a range of tools to digitise and automate your compliance learning. These include our:
If you’d like to access leading insights and compliance tips, browse our free resources by topic to find guides, modules, compliance bites and more.
Written by: Martin Schofield
Martin has over two decades of experience at the front-line in compliance, financial crime prevention and data protection, along with a further decade of experience consulting, in-person training and interacting with professionals at hundreds of firms. He is a keen promoter of joined-up thinking in compliance training and management and of creating a culture that gets employees at all levels engaging with the compliance department.
