Data Protection – response to Subject Access Request (SAR)
Section 45 of the Data Protection Act 2018, provides an unfettered right for any living person, (not a relative or the estate of a dead person) to obtain from a commercial organisation, facsimile copy of any data held against his/her name.
The Act is quite explicit and SAR’s are now being used increasingly often, simply because of the wide publicity given to the provision. As a general rule, once a request is received, within a month of the date of the SAR, the person making the request, the “data subject,” has to be provided with copies of all data held against his/her name.
That is the general rule but there are certain exemptions; it is quite often the case the holders of the data do not have to provide any information or if they have to respond, make limited disclosure. If the data holder makes improper disclosure, which would identify a third party, then a data breach has occurred and a criminal offence committed.
If you receive a subject access request, it would be advisable to contact AAL before compiling a response.
AAL can provide a draft SAR on application. For further information Contact Us.