Subject access requests can be made by anybody in the UK who thinks a company holds their personal data. You can submit a subject access request (SAR) to find out what data a company holds, why they hold it, and how they’re processing that data. Under the Data Protection Act 2018 you are entitled to know what personal data of yours is held, especially if that data can identify you.
But what happens if you make a SAR and the company you have contacted refuses to respond directly? The Information Commissioner’s Office (ICO) has some guidance on this, but we’ll explain your rights, what to do, and how to pursue the matter further if necessary below.
What is a subject access request?
A subject access request (SAR) is made by an individual who wants to know what personal data a company has about them, why they have it, and how that data is being stored and processed.
Personal data refers to any information that relates to an identified or identifiable individual. Where an individual has been identified in a data breach, this is especially worrisome, but you can find out what identifiable data a company holds about you even if no breach has occurred.
Essentially it is an information request which is protected by data protection law. That means you can make as many SAR requests as you like, within reason.
How do I start the SAR process?
Starting the SAR process is incredibly simple. All you have to do is request access to the data the company holds about you. You can contact a manager, HR, or data protection officer, depending on the structure of the company. Regardless, even if you contact the wrong person initially, you should be given the contact details of the person who can check what personal data the company holds about you.
What to include in a subject access request
The following is usually standard form when making a subject access request:
- “Subject access request” as the header line (handwritten letter) or subject (email)
- Date of request
- Full name
- Contact details – email, phone number, home address
- Account numbers – this may be a customer account, NHS number, employee number etc depending on where you’re making your request
- The personal data you would like to know (be very specific to avoid confusion or the company trying to get away with giving you the minimum)
- Details about the information that may help them locate it – e.g. date you may have provided the data etc
- Reason for the requested information (not necessary but can spell out the reason for the request and the company may be more willing as a result)
- How the information can be sent to you – email, post, etc
You can also make a verbal request over the phone, but you won’t necessarily have evidence of your conversation with the organisation contact, so getting your request in writing using clear and plain language is usually better than making your request verbally.
Does it cost to submit a SAR?
No, it shouldn’t cost to make a SAR for your personal data if it’s the first time you’re making a request. It shouldn’t cost if it’s the second, third, or fourth time with a company either.
However, a company is legally allowed to request a reasonable fee if they’ve made reasonable efforts to provide you with data in the past and your requests are now considered to be “manifestly unfounded or excessive”.
Essentially, it’s free to make a reasonable request for personal data info, but if you abuse your right, you will start being charged for each SAR you make.
Can I submit a subject access request for my child?
Absolutely, but you will need to provide evidence of your parental responsibility in order to get access to your child’s personal data.
When exercising subject access rights on behalf of your child, be prepared to go back and forth for further information. Of course, you’re acting in your child’s best interests but the company will need to protect themselves by ensuring they don’t disclose information illegally.
It may take longer to receive personal data when you’re making a request on behalf of someone else, but you still have every legal right to do so on behalf of a child or young person in your care.
How quickly should I hear back?
After submitting a SAR, you should receive a SAR response within one calendar month. This is the time frame in which a company has to acknowledge your subject access request. This isn’t, however, the deadline in which the company has to provide you with your data.
They should respond within one calendar month, but only to acknowledge your request and give you a timeframe in which you can expect to receive any relevant information about your personal data – this could be a further two calendar months.The key point to remember here, though, is that the company, by law, must respond effectively within one calendar month to at least acknowledge your request.
What do I do if there’s a delay?
If there’s a delay – anything over one calendar month since the date you made your request – you should send a follow-up letter or email to get the company’s attention.
In this letter/email, remind them of their obligation to reply to your SAR within one calendar month, explain that they have breached that obligation and that you will take further action if you do not hear back from them within a specific time limit.
Can a company refuse a SAR?
You might hear back from a company who has refused your SAR. It can feel wrong, but the company is well within their legal right to refuse your subject access request if they have good reason to do so, and so long as they explain their reasons to you.
They could refuse for a myriad of reasons, but some may be to do with not being able to find any data relating to you after a reasonable search (their data retention policy may mean they delete old data as good practice), and others may be to do with your data being intertwined with someone else for example.
So long as they provide good reason for refusal, they are within their right to do so. You can, however, send in more SARs if you’re unsatisfied with the outcome of your request.
What happens if I contact them again and hear nothing?
If you still haven’t heard anything following a further request, then you should contact the company again in the first instance, one final time, and then if you hear nothing back again, escalate the matter to the ICO.
Complain To The Company
Your first port of call should be to contact the company with a complaint, one last time, reminding them of their legal obligation to at least acknowledge your request. You should let them know your intent to file a complaint with the ICO if they do not reply within a specific time limit again. You can also point them towards ICO guidance which highlights their legal obligation. You should make the time limit you give them shorter than your previous ones, but a week is usually fair. After this, move on to the next point.
Complain To The ICO
If you don’t hear back from the company who you have requested a subject access request from, then you can always contact the Information Commissioner’s Office (ICO). The ICO’s complaint process is simple to follow.
If your complaint is successful then the ICO will talk with the company and explain the action they need to take in order to be compliant with the law. Failure on behalf of the company to respond appropriately to the ICO’s request could lead to hefty fines or criminal prosecution.
Your GDPR rights
Under GDPR (General Data Protection Regulation) laws and guidance, you have a few different rights with regards to your personal data.
These include:
- Right to be informed
- Right of access
- Right to rectification
- Right to erasure
- Right to restrict processing
- Right to data portability
- Right to object
- Rights related to automated decision making
If a company violates any of your GDPR rights, then you can complain, and in the worst cases, pursue compensation.
Next steps
Once your complaint is with the ICO, you may have to wait at least 14 weeks for the complaint to be processed and then you’ll need to wait for the ICO to get in touch with the company to try and resolve the issue. It’s possible that the case will be taken to court, which will take even longer.
If the ICO finds in your favour and the company eventually replies to your subject access request, then you could be entitled to claim compensation for a breach of your GDPR rights. You can check if you could claim compensation for free with DataBreach Claims today!
