Shorter Reads

Data Subject Access Requests: Six key issues for HR Teams

Data Subject Access Requests (DSARs) are now commonly made by disaffected employees, or those facing disciplinary action.

2 minute read

Published 4 April 2022

Authors

Share

Key information

The Data Protection Act 2018, incorporating UK GDPR, has raised the profile of individual data rights. Data Subject Access Requests (DSARs) are now commonly made by disaffected employees, or those facing disciplinary action. They can be time consuming and disruptive to deal with, so it is vital that organisations, and their HR functions in particular, know how to recognise them, who has responsibility for coordinating a response, and what procedures need to be followed.

So what are the key issues?

1. How do I recognise a DSAR?
There is no set form for a DSAR. Any oral or written request to see what personal data an organisation holds, is likely to be a DSAR. Staff should be trained to recognise a potential request and know where to refer it. Either a Data Protection Officer (DPO) or a dedicated manager with both the authority and responsibility to deal with DSAR responses is needed. This can be within HR or a legal/compliance function. A formal policy and procedure can help to streamline the process.

2. Who can make a DSAR, and when does the clock start?
Typically, it will be an employee or a customer, but it could be any living individual. The first priority is to confirm the identity of the requester. If there is any doubt, you should ask for verification, like a photo ID. The clock starts as soon as the request is received, but it can be paused if verification is needed. A full reply should be given within one month unless the request is complex, so any delay in the process risks becoming a breach.

3. What data needs to be disclosed?
A DSAR can either be general (all personal data) or specific, e.g. data in notes of meetings and discussions which led to disciplinary action being taken. Personal data is widely defined so you will need to carry out a search wide enough to capture everything of possible relevance and then conduct a manual review. HR records are likely to be a key source of personal data.

‘Data’ is not necessarily the same as ’documents’. There is no obligation to disclose documents, although that may be the simplest way to provide the data.

If documents contain the personal data of more than one individual, great care should be exercised. You may need either to ask for consent to such disclosure, or to redact data that does not relate to the requester. Disclosing someone else’s data without a valid reason will be a data breach. There may also be sensitive or confidential data which needs to be carefully assessed to establish whether it needs to be disclosed or not.

4. Do any exclusions apply?
There are a number of exclusions that may apply in any particular case, but these are all narrowly defined, so you must be absolutely clear that they apply rather than take a chance.

5. Can I refuse to respond?
Unless a specific exclusion applies, no. If a request is either ‘manifestly unfounded’ or ‘manifestly excessive’ then you may refuse to respond, but the bar is a high one, so you must be able to explain in detail why you believe they apply.

Conclusion

There are numerous pitfalls in responding to a DSAR. Getting it wrong will be a data breach. A regulatory investigation by the Information Commissioner’s Office (ICO) can result in enforcement action (including hefty fines), and a possible claim for damages by the data subject(s).

DSARs are clearly on the increase, so it will be a sound investment for businesses to be prepared. Even organisations with a dedicated DPO and detailed policies and procedures can find it helpful to seek external advice, and if you have neither, an independent expert can significantly reduce both the risk and the stress.

This article was first published on People Management 

Related latest updates
PREV NEXT

Related content

Arrow Back to Insights

Shorter Reads

Data Subject Access Requests: Six key issues for HR Teams

Data Subject Access Requests (DSARs) are now commonly made by disaffected employees, or those facing disciplinary action.

Published 4 April 2022

Associated sectors / services

  • Data Protection

Authors

The Data Protection Act 2018, incorporating UK GDPR, has raised the profile of individual data rights. Data Subject Access Requests (DSARs) are now commonly made by disaffected employees, or those facing disciplinary action. They can be time consuming and disruptive to deal with, so it is vital that organisations, and their HR functions in particular, know how to recognise them, who has responsibility for coordinating a response, and what procedures need to be followed.

So what are the key issues?

1. How do I recognise a DSAR?
There is no set form for a DSAR. Any oral or written request to see what personal data an organisation holds, is likely to be a DSAR. Staff should be trained to recognise a potential request and know where to refer it. Either a Data Protection Officer (DPO) or a dedicated manager with both the authority and responsibility to deal with DSAR responses is needed. This can be within HR or a legal/compliance function. A formal policy and procedure can help to streamline the process.

2. Who can make a DSAR, and when does the clock start?
Typically, it will be an employee or a customer, but it could be any living individual. The first priority is to confirm the identity of the requester. If there is any doubt, you should ask for verification, like a photo ID. The clock starts as soon as the request is received, but it can be paused if verification is needed. A full reply should be given within one month unless the request is complex, so any delay in the process risks becoming a breach.

3. What data needs to be disclosed?
A DSAR can either be general (all personal data) or specific, e.g. data in notes of meetings and discussions which led to disciplinary action being taken. Personal data is widely defined so you will need to carry out a search wide enough to capture everything of possible relevance and then conduct a manual review. HR records are likely to be a key source of personal data.

‘Data’ is not necessarily the same as ’documents’. There is no obligation to disclose documents, although that may be the simplest way to provide the data.

If documents contain the personal data of more than one individual, great care should be exercised. You may need either to ask for consent to such disclosure, or to redact data that does not relate to the requester. Disclosing someone else’s data without a valid reason will be a data breach. There may also be sensitive or confidential data which needs to be carefully assessed to establish whether it needs to be disclosed or not.

4. Do any exclusions apply?
There are a number of exclusions that may apply in any particular case, but these are all narrowly defined, so you must be absolutely clear that they apply rather than take a chance.

5. Can I refuse to respond?
Unless a specific exclusion applies, no. If a request is either ‘manifestly unfounded’ or ‘manifestly excessive’ then you may refuse to respond, but the bar is a high one, so you must be able to explain in detail why you believe they apply.

Conclusion

There are numerous pitfalls in responding to a DSAR. Getting it wrong will be a data breach. A regulatory investigation by the Information Commissioner’s Office (ICO) can result in enforcement action (including hefty fines), and a possible claim for damages by the data subject(s).

DSARs are clearly on the increase, so it will be a sound investment for businesses to be prepared. Even organisations with a dedicated DPO and detailed policies and procedures can find it helpful to seek external advice, and if you have neither, an independent expert can significantly reduce both the risk and the stress.

This article was first published on People Management 

Associated sectors / services

  • Data Protection

Authors

Need some more information? Make an enquiry below.

    Subscribe

    Please add your details and your areas of interest below

    Specialist sectors:

    Legal services:

    Other information:

    Jurisdictions of interest to you (other than UK):



    Article contributor

    Enjoy reading our articles? why not subscribe to notifications so you’ll never miss one?

    Subscribe to our articles

    Message us on WhatsApp (calling not available)

    Please note that Collyer Bristow provides this service during office hours for general information and enquiries only and that no legal or other professional advice will be provided over the WhatsApp platform. Please also note that if you choose to use this platform your personal data is likely to be processed outside the UK and EEA, including in the US. Appropriate legal or other professional opinion should be taken before taking or omitting to take any action in respect of any specific problem. Collyer Bristow LLP accepts no liability for any loss or damage which may arise from reliance on information provided. All information will be deleted immediately upon completion of a conversation.

    I accept Close

    Close
    Scroll up

    Find out about Business

    Find out about Dispute Resolution

    Find out about Individuals & Families

    Find out about Real Estate

    We are Collyer Bristow - The law firm for those that
    value individuality, creativity and collaboration.

    Legal & Pricing info Regulatory InformationAccessibilitySitemapPricing and service information

    Read our latest article: BUILDING SAFETY ACT AND REMEDIATION CONTRIBUTION ORDERS: CONSIDERATIONS FOR INVESTORS

    Read our latest article: ‘Long Term Residence’ in the UK: Tax Consequences for International Private Clients

    Read our latest news: Stephen Gawne named by clients as a Thomson Reuters “Stand-out Lawyer”

    Read our latest news: Write your next chapter | apply for your Training Contract with Collyer Bristow

    Read our latest article: How to register as a British citizen

    ExpandNeed some help?Toggle

    < Back to menu

    I have an issue and need your help

    Scroll to see our A-Z list of expertise

    Get in touch

    Get in touch using our form below.



      Business Close
      Private Wealth Close
      Hot Topics Close