Support with Data Subject Access Requests
Even under ‘good’ circumstances, the impact on your organisation of a Data Subject Access Request (‘DSAR’) is not to be underestimated.
4000: The average number of documents that needed to be provided in response to the DSARs that we have assisted our clients in responding to.
30: The number* of calendar days, from the date of receipt, that an organisation has to completely fulfil a DSAR.
*Under most circumstances
48: The average number of hours 'lost' by senior / specialist staff dealing with a single DSAR; equating to a loss of almost £15000.00 in fee earning time.
Increasing: The number of DSARs issued by unscrupulous and poorly informed individuals with the intention of causing massive inconvenience to your organisation or otherwise to ‘fish’ for information in already sensitive situations such as complaints and disciplinary matters.
We will help you to expedite the request and guide you as to what you should be providing and just as importantly; what you shouldn't.
As with everything else that we do, all work is intended to be conducted on a fixed fee basis.
Processing a DSAR most often takes the following route:
The process in detail:
Phase 1: Clarifying what needs to be done
- You provide us with a copy of the DSAR for our perusal.
- If necessary, we will discuss with you to clarify key points.
- We respond to you, in writing, to set out:
- What documents and information should be provided to the Requestor.
- Guidance as to any documents that would not necessarily be required to satisfy the DSAR.
- Any ramifications or points of concern in light of any current action to date.
- A summary of suggested timelines for the completion of the work.
You and your team now have the information you need to be able to gather and collate the information/documents to send to the Requestor.
This can be quite laborious and might take your team a couple of days, depending upon the complexity.
However, in most circumstances, you will not need to individually catalogue each and every document.
Phase 2: Fulfilling the DSAR
- We will discuss and resolve your queries with you as you gather the documents.
- Having gathered the documents together, you would provide us with a report as to what documents /information have been collated so that we can provide our remarks as to the appropriateness of the portfolio to support the best possible information being provided to the Requestor to satisfy the DSAR.
- With visibility of the portfolio that is to be sent to the Data Subject, we draft an ‘Accompanying Letter’ to be provided to you so that you can copy and paste the letter into your own communication format, for the you to send to the Requestor.
- The draft letter would include at least a description of what is being sent to the client, a description as to why it is being processed, and any other information that might be considered appropriate in the context of the DSAR.
Important aspects of DSARs
Under the old Data Protection Act 1998 regime, a DSAR had to be made in writing and a charge could be made for the response. Those days are gone.
A DSAR can now be submitted in any form (writing, email, text message, phone call, in person, by web-form, etc) and under most circumstances a charge cannot be made.