Handling Data Subject Access Requests From Employees

Our team of experts in data protection law advise employers on handling Data Subject Access Requests (sometimes referred to as a SAR or DSAR), making sure they are transparent and compliant with the regulations.

Responding to a SAR from an employee

All employees have the right to make a subject access request to enable them to see what personal data employers process about them. It is relatively easily for the employee but for an organisation to respond it can take a significant amount of time and resources. Furthermore, should an individual be dissatisfied with how you have handled their request, then that individual can complain to the Information Commissioner’s Office (ICO.

The team at Kuits specialises in supporting employers to comply with data protection laws and provide comprehensive guidance on managing SARs from an employer’s perspective. This involves helping you comply with your data protection obligations, whilst also protecting your organisation. Our team has significant experience in dealing with the ICO and ensure that the client’s interests are protected.

We help clients concentrate their efforts by making sure that, when faced with a SAR, they only search for what’s reasonable and fair while also applying disclosure exemptions which means they are not revealing anything unnecessary or unlawfully sharing personal data about other individuals when complying with the SAR.

Tips for responding to a SAR

1. Recognise the Subject Access Request
2. Identify the individual making the request
3. Establish timeframes to respond
4. Agree the scope and search terms
5. Consider the extent of the search on your systems
6. Identify data to be disclosed
7. Consider third party personal data
8. Identify whether any exemptions apply
9. Securely disclose the personal data
10. Keep a record of decisions made

Implications and penalties for non-compliance with GDPR

If an employer fails to comply with a SAR, the ICO can take enforcement action against them for their failure to comply with data protection legislation. This can range from being required to take corrective action following what can be an invasive investigation, to the imposition of significant penalties. Organisations found in violation may face fines of up to £17.5 million or 4% of their global annual turnover, whichever is higher.

Our highly experienced team can assist clients in meeting their data protection obligations to safeguard their reputation and avoid these consequences.