How do you handle a data access request?

How to respond to a subject access request: a step by step guide for organisations

30 April 2019.
Recognise the subject access request.
Identify the individual making the subject access request.
Act swiftly and clarify the subject access request.
identify personal data to be disclosed.
Identify personal data exemptions.

What is a data access request?

What is a Data Subject Access Request? A DSAR is a request from someone you store data on (called a data subject) to your organization. They can submit this request at any time. You are obligated to respond with a copy of any relevant information you have on the subject.

What is a subject access request in education?

A subject access request (SAR, also called a data subject access request (DSAR), is any request by a data subject for access to their personal data. Those with parental responsibility for students aged 18 and under can also request a copy of their child’s pupil record.

How do you request a subject access to a school?

A clear heading for your request (for example, use ‘subject access request’ as your email subject line or a heading for your letter) The date of your request. Your name. Any other information used by the organisation to identify or distinguish you from other individuals (for example, customer account number)

How do you respond to a data subject access request?

If you got the SAR by email, you should reply by email, unless the requester has said otherwise. Check with them what format they’d like it sent in and give it a final check with steps seven and eight in mind.

How do you handle a subject access request GDPR?

You must comply with a SAR without undue delay and at the latest within one month of receiving the request. You can extend the time to respond by a further two months if the request is complex or you have received a number of requests from the individual, eg other types of requests relating to individuals’ rights.

What are the main principles of GDPR?

The UK GDPR sets out seven key principles:

Lawfulness, fairness and transparency.
Purpose limitation.
Data minimisation.
Accuracy.
Storage limitation.
Integrity and confidentiality (security)
Accountability.

What is the purpose of a data subject access request?

The General Data Protection Regulation (GDPR), under Article 15, gives individuals the right to request a copy of any of their personal data which are being ‘processed’ (i.e. used in any way) by ‘controllers’ (i.e. those who decide how and why data are processed), as well as other relevant information (as detailed …

How long should an SAR take?

An organisation normally has to respond to your request within one month. If you have made a number of requests or your request is complex, they may need extra time to consider your request and they can take up to an extra two months to respond.

What can I request under GDPR?

What information should be included in a subject access request?

You make a subject access request to your bank for full copies of your bank statements. Your bank is not required to provide copies of the actual bank statements, but they must provide you with your personal data contained within them, for example, by providing you with a list of transactions.

What is the DPO responsible for?

Data protection officers (DPOs) are independent data protection experts who are responsible for: Monitoring an organisation’s data protection compliance; Informing it of and advising on its data protection obligations; Providing advice on DPIAs (data protection impact assessments) and monitoring their performance; and.

A verbal or written request made by a data subject to: access their data (in a portable format if requested), be informed about how it is used, to have their data modified if it is incorrect, or to have it deleted…. Acknowledge receipt and explain how you will review and respond to the request

What should I do if I receive a data subject access request?

Always ensure you keep an exact copy of all the information sent and keep a record of your response in your Data Subject Access Request log. The number of DSARs continues to increase as individuals better understand and exercise their rights under the GDPR.

What is a DSAR request?

Recognising and receiving DSARs An individual who can be identified or is identifiable from data…. ) asking what PII you hold on them. There is no specific format required to initiate a request for a DSAR – we’ve seen requests made verbally, by letter, email, online chat facility and even by social media post – all are equally valid.