Understanding the Right of Access: What Your Company Needs to Know
The UK GDPR gives individuals the right to access their personal data. Here’s what companies need to know about handling Subject Access Requests (SARs) effectively.
The UK GDPR gives individuals the right of access under Article 15. This allows people to ask what personal data your company holds about them and request a copy.
SARs often come from current or former employees, clients, or job applicants. You must:
- Respond within 1 month (extendable by 2 for complexity)
- Not charge a fee (unless the request is manifestly excessive)
- Include relevant data from emails, HR systems, databases, etc.
- Redact third-party data or obtain consent where necessary
Getting this wrong can result in ICO action or legal claims.
đź’ˇ Tip:
Build a SAR protocol now, including logging, templates, and review steps. You’ll thank yourself later.
