In May 2023, the ICO published a new guide on responding to subject access requests
The right of access, commonly referred to as a subject access request or SAR, gives someone the right to request a copy of their personal information from organisations.
This includes where they got their information from, what they’re using it for and who they are sharing it with.
Individuals can request the personal information held by their employer, or former employer, such as details of their attendance and sickness records, personal development
or HR records. Failing to comply to SARs is non-compliant with the law. If organisations fail to respond to SARs promptly, or at all, they can be subject to fines or reprimand.
Read in full here https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employers/sars-qa-for-employers/
Elanor McCombe, Policy Group Manager at the Information Commissioner’s Office reports that: “The right of individuals to access information that organisations hold on them is one that is vital for transparency, and is enshrined in law. What we’re seeing now is that many employers are misunderstanding the nature of subject access requests, or underestimating the importance of responding to requests. For example, employers may be unaware that requests can be submitted informally, such as over social media, or do not have to contain the words ‘subject access request’ in order to qualify as a legally binding request. Similarly, employers may not realise that there is a strict time frame for responding to requests, and this must be kept to.”
RELATED EVENT:
Responding to Subject Access Requests for Health & Social Care
Virtual CPD Masterlcass
Facilitatied by:
Barry Moult
IG Consultant BJM IG Privacy Ltd, Former NHS Trust Head of Information Governance, and Winner of the ICO’s Practitioner Award for Excellence in Data Protection 2020.
