UK: Data Protection – Subject Access Requests (SARs)

The key areas covered by the guidance include:

What amounts to a “manifestly excessive” SAR: The employer must determine whether the SAR is “clearly or obviously unreasonable”. This involves assessing whether the response required is “proportionate when balanced with the burden or costs involved”. All the circumstances must be taken into account, including: the nature of the information, the context of the request, whether not complying with the SAR could cause substantive damage to the employee, the employer’s available resources, etc.

What is a “reasonable fee” for complying with a manifestly excessive or unfounded SAR:
In addition to photocopying and printing costs etc, employers can take into account administrative costs related to assessing, locating and copying the information, and communicating with the employee.

Stopping the clock when clarification of the SAR is required:

Potentially, employers can “stop the clock” on the 30 day time limit for compliance with a SAR, if clarification is “genuinely required” and the organisation processes a large volume of information about that employee. Whether you hold a large amount of information about an individual will, to an extent, depend on the size of the organisation and the resources available. The volume of information held may be less of an issue for a large organisation which has significant dedicated resources available to respond to SARs.

Practical point 

The guidance does not alter the existing law but provides clarification for employers on how to deal with SARs, as well as helpful examples.

For more information on these articles or any other issues involving labour and employment matters in the United Kingdom, please contact Robert Hill (Partner) at Clyde & Co at robert.hill@clydeco.com or visit www.clydeco.com.