Under the General Data Protection Regulation (GDPR), there’s a specific way to deal with data subject access requests. But how can you manage them effectively while remaining compliant?
Companies hold individuals' personal information, and they have the right to access it. Refusing to provide it is acceptable only if an exemption or restriction applies or the request is manifestly unfounded or excessive.
Individuals (data subjects) have the right to access and receive a copy of their personal data and other supplementary information. This is commonly referred to as a data subject access request or 'DSAR'.
In general, companies have to respond to a DSAR without undue delay. The longest you can wait is a month from the time you receive the request. Failing to reply at all after 40 days can result in regulatory action and fines.
You can extend the time limit by a further two months if the request is complex or you’ve received multiple ones from the same individual.
Nigel Farage claimed his bank accounts had been closed by Coutts, a private bank, because of his political views. After Farage's DSAR to Coutts, there was a raft of other DSARs to banks. Coutts responded to Farage's DSAR by providing a 40-page document. This included details of his account as well as communications between Coutts and the media about him.
This case revealed that banks keep detailed records about their customers, including information on their political views and communications with the media. The ensuing raft of other DSARs to banks put pressure on them to be more transparent about how they collect and use customer data. This also opened the door to banks coming under fire for violating people’s privacy.
DSARs are challenging for the construction industry because of its vast, dynamic, decentralised, unstructured and fragmented nature. Multiple stakeholders, frequent project turnovers, and large workforces increase the risk of data mishandling.
However, these challenges can be managed effectively through centralised data management systems, comprehensive employee training and dedicated compliance teams.
Responding to DSARs within a specific timeframe is a compliance requirement. Failing to adhere to this legal obligation could result in regulatory investigation and action – the Information Commissioner's Office (ICO) issues reprimands and fines.
A reprimand is a written notice that details key compliance issues the ICO finds and sets out breached provisions of the legislation. It also recommends how the company can improve its compliance.
Fines can be up to £17.5 million or 4% of the company's total annual worldwide turnover in the preceding financial year – whichever of the two is higher.
Furthermore, individuals who don’t have their DSARs handled correctly and experience distress can seek financial compensation. These consequences not only impact a firm financially but also damage its reputation.
The organisations listed below collected and processed personal data and then failed, on multiple occasions, to respond to DSARs either within the legal timeframe or at all. The ICO has taken regulatory action by issuing a reprimand against the following organisations:
GDPR Article 12 (5) states that the response to a DSAR must be provided free of charge, except when the request is deemed manifestly unfounded, excessive, or repetitive in character. In that case, the data controller can levy a reasonable fee, taking into account the administrative burden associated with a response, or refuse to act on the request.
Either way, the burden of proof regarding whether the request is manifestly unfounded, excessive or repetitive lies firmly with the data controller. When choosing not to reply to a request, they must, within one month, advise the data subject why and offer the right to lodge a complaint or refer the matter to the supervisory authority.
According to the ICO, factors that may indicate a manifestly unfounded and excessive DSAR are:
“The person systematically or frequently sends different requests to you as part of a campaign with the intention of causing disruption, eg once a week”
Under Article 15 of the GDPR, a controller must provide confirmation of processing, access to the personal data, and supplemental information such as:
Plus, where relevant, safeguards for international transfers.
Yes. Controllers should apply reasonable identity verification measures to ensure they don't disclose data to the wrong person. However, it’ is important not to request excessive or unnecessary documentation, especially formal ID, if other reasonable methods (such as email verification or an identity-proofing platform) are available.
GDPR mandates response "without undue delay" and within one month of the request, or from receipt of necessary information to verify identity or a valid fee. That deadline runs to the same calendar date the following month; if that date doesn't exist (for example, from January 31st), the deadline is the last day of the next month. If it falls on a weekend or holiday, apply the next working day.
A controller can extend the deadline by up to two months if the request is complex or the data subject has submitted multiple rights requests simultaneously (for example, access, erasure, portability). However, the extension must be issued within the initial one-month period, providing reasons for the delay.
If you’re looking for focused training, our Data Protection and GDPR Compliance Training Hub offers a complete solution for your compliance programme. Courses include:
Our e-learning courses are designed to engage employees, including our microlearning library, which supports knowledge retention.
Our Compliance Portal also features a range of tools to digitise and automate your compliance learning. These include our:
If you’d like to access leading insights and compliance tips, browse our free resources by topic to find guides, modules, compliance bites and more.