Sometimes an Employer will find itself on the receiving end of a Data Subject Access Request (also known as a "DSAR" or "Subject Access Request").
An expert Data Subject Access Request solicitor can advise on the law surrounding these types of requests.
A DSAR is a right that an individual has to request a copy of their personal information. For Employers, such requests can often come from unsuccessful job applicants, current employees or disgruntled ex-employees.
A specialist employment solicitor can advise you on how best to approach the request to ensure you are able to respond appropriately and within the required timescales.
A DSAR must be dealt with without undue delay and at the latest within one month of receipt of the request. This deadline to respond to a DSAR can be extended by a further two months if the request is complex or a number of requests have been received from the individual.
Employers need to act promptly when they receive a DSAR. The time limit commences from receipt of the DSAR, or receipt of information requested by the Employer to confirm the individual’s identity (where that person’s identity is not obvious) or a fee (in circumstances where the Employer is entitled to charge one).
The next step for the Employer will be to consider the scope of the request and to locate and retrieve the data. This can be a time-consuming and difficult process particularly where the individual has made a general request for all of their personal data and where there is a significant amount of data to retrieve and review.
Inevitably, the Employer’s DSAR search results will sometimes include emails and documents that also relate or refer to other individuals. How should the Employer handle this? It is important to note that the individual making the DSAR is only entitled to their own personal data. It is therefore important that the Employer deals appropriately with the data collated and considers whether there is any third-party data or any legal exemptions which apply to exclude particular documents from the scope of the request.
A DSAR can be made in writing or verbally, and does not have to include the words ‘data subject access request’. A DSAR can even be made via social media and does not need to be directed to a particular person. It is therefore imperative that you and your workforce recognise when a request of this nature is being made.
Our expert employment law solicitors are able to offer specialist DSAR advice to employers, along with all other areas of employment law.
Holmes & Hills Employment lawyers offer GDPR training sessions to help you not only identify and manage these types of requests but put in place best practice when dealing with data, to help deal with these requests in a more efficient matter.
A Mackman Group collaboration - market research by Mackman Research | website design by Mackman
