Getting Subject Access Requests (SARs) Right

What are subject access requests?

Individuals have a right to access and receive a copy of their personal data under the UK general Data Protection Regulation (GDPR) and this is known as a subject access request (SAR).

A SAR can be made verbally or in writing and this includes via social media and the request does not need to state that it is a SAR.

Who can make a SAR?

Individuals can make SARs as well as third parties on behalf of another person. If a child is mature enough to understand their rights, even they can make a SAR and you can respond directly to them.

In relation to schools, parents or guardians may make a SAR for information you hold about a child or children. If the request is from a parent or guardian exercising the child or children's rights, you can respond if the child or children authorise it or if it is in the best interests of the child or children.

Timeline

You must respond to a SAR within 1 month of a request although this can be extended by a further two months if the request is complex or you have received a number of requests from an individual.

Responding

• You can refuse to provide some or all the information if an exemption applies or if it is manifestly unfounded or excessive.

• How can schools prepare for SARs?

• Know how to recognise a SAR and have a policy and processes in place

• Keep a record of requests

• Understand when a request can be extended or refused

• Have suitable management systems in place to locate and retrieve information

• Document and review all personal information held, how data is collected and stored

Training

At Forbes we have a data protection and GDPR specialist team who offer a wide range of advisory services, DPO support packages and regularly advise schools on SARs. Should you have any further enquires, require more information or support please do not hesitate to contact either Daniel Milnes or Gemma Duxbury.