10 questions you should ask before making a Subject Access Request

What is a Subject Access Request (SAR)?

Employment law can be a confusing world for an individual to comprehend. But, as an employee you have certain rights, one of which is the right to request a copy of any information that an organisation is holding about you. This is known as a Subject Access Request or SAR.

To ensure that you receive the data you’re looking for, it’s vital that your request is well thought out. In some circumstances an organisation can refuse to comply. To make sure that it’s successful, here are the 10 most important questions you should ask yourself before making a Subject Access Request.

Is it in the right form?

A Subject Access Request must be in writing, which could be an email. In some cases you might be asked to provide identification and a £10 fee to access the information. This is at the organisation’s discretion. If you plan ahead, you can make sure that you have all the information that’s needed to make your request. Sometimes an organisation will ask you to fill in a specific form. This isn’t compulsory, but you may find that it speeds up the process if you do.

 Are your expectations realistic?

A SAR will only relate to personal data about yourself. You’re not entitled to see information about other people, although this may be allowed in certain circumstances. Because of this, it’s possible that you won’t be provided with the full document containing your personal data, just the sections relating to you. Remember this when you’re drafting the request.

Have you provided all relevant information?

An organisation can’t ask you to change the scope of your request but it won’t provide any data until it has received all of the information it needs in order to source what you’re asking for. Give clear and detailed information so that the organisation can find any data quickly and easily. This could include the location of the information or any key words that might aid in the search. By doing this, you can ensure that the start of the 40 day deadline to respond won’t be delayed.

Have you asked the right questions?

A wide request for information will result in the organisation providing you with a large amount of data. This is fine if that’s what you want, just be prepared for the time it might take to review it. It’s also worth remembering that an organisation is likely to go through all of your personal data, which might include your emails.

Who is the relevant data controller?

Make sure you know who processes and manages the personal data for an organisation. This will ensure that you are addressing the Subject Access Request to the right people. In the case of large groups of companies, you might need to make more than one request. If there’s any doubt, make requests to any and all potential data controllers.

Are you good at keeping records?

You’ll need to be. Record all correspondence and make certain that you note the start of the 40 day deadline. This will help if a dispute is raised about the organisation complying with the request.

Did you know that you’re entitled to more than just your personal data?

You’re also entitled to a description of the data that’s held about you and the reason why it’s held.  This is often forgotten but can be useful, so make sure it’s included.

What if they withhold information?

If you think that any information has been withheld, contact the organisation and remind them of what’s required. Some information may have been exempt from disclosure, if this is the case you should have been notified.

Do you have the contact details for the ICO?

You can also report any concerns you might have with the Information Commissioner’s Office. If you haven’t received a response within the 40-day deadline, or you believe the organisation is still withholding personal information, the ICO can offer help and advice.

Have you looked at other options?

If a Subject Access Request is used during a dispute between yourself and the organisation, and it doesn’t provide you with the information you require, other options are available, including pre-action disclosure.