You come into work on Monday morning, log in to your emails and find a customer demanding their personal data from your organisation.
You're confused. You've never had to deal with this before.
You know you can't afford to do nothing or there could be some serious consequences for your organisation (more on this later!)
Unfortunately, although we're all aware of how important GDPR and data protection is, lots of people struggle with how to properly handle subject access requests.
The good news is this article will outline the solution you're looking for in an easy step-by-step format.
Ready to let go of the stress?
Let's get into this.
For something to be considered personal data:
Whenever your customers ask for their personal data, it is known as a 'Subject Access Request'.
According to the ICO's code of practice, a Subject Access Request is defined as:
"a written request made by or on behalf of an individual for the information which he or she is entitled to ask for under section 7 of the Data Protection Act 1998".
Section 7 states that individuals are entitled to access any information that an organisation holds about them and this is why you've received the request.
Now, this part's important - you do have a subject access request response time limit.
Your organisation has 30 calendar days to respond to the subject access request.
You may be tempted to put it off or ignore the subject access request altogether but this could be seriously putting your organisation at risk. Here's what can happen if you decide to become complacent with GDPR:
You get the point, don't ignore a subject access request!
According to the ICO, you can refuse an entire request when:
Individuals receive a copy of their personal information but they are also authorised to access more than just the copy:
As aforementioned, requests can come from anywhere and everywhere. You have to ask yourself whether you believe you have the measures in place which will allow your organisation to handle every single request that comes through.
So how do you make sure your organisation is set up in a way that enables you to successfully deal with these requests?
Firstly, even if you have a dedicated person who deals with client and customer data, anybody in your organisation could receive a subject access request at any moment. This is why it's important everyone understands what they need to do when a subject access request is received.
This will involve training for your employees.
It is incredibly important for all employees to have data protection training to be able to recognise a subject access request.
This means employees should be aware of what a subject request access is and the relevant employees need to be able to deal with the requests.
For instance, the receptionist should be able to confidently pass on the information to the relevant people who can deal with the request. These people will need more detailed training as they will most likely be taking positions of data controllers and data processors.
Secondly, you should look to give guidance to both customers and employees.
Employees should be provided with written guidance, for instance, a PDF that outlines the policies and procedures required.
For customers, you should look to create a dedicated in-house form to assist customers in providing details about their request, identities and any other information which will help you complete the request.
This should make it easier for customers to complete requests without the need to complain.
Lastly, once you've offered guidance and training, you need to track your compliance with subject access requests. This means your organisation is constantly reviewing the status of each request and ensuring that every request is completed in the 30 calendar day time frame.
Now that you understand what Subject Access Requests involve, let's go over what you need to do in a step-by-step to respond to these requests.
It isn't always easy to identify a subject access request as an individual doesn't need to use the phrase "subject access" or reference the data protection act for it to qualify as a Subject Access Request.
There is no specific or prescribed way for individuals to make a request, which means a request can come from a multitude of different sources.
This could include but is not limited to:
Whether the request has come from e-mail, post or a social media message, you need to act upon that request.
Once you have recognised the request, ask yourself, does this request fall within the definition for personal data? Individuals can only request information that relates to themselves, not other people.
Also, it is important to recognise whether the individual is asking for more than just their personal data. For instance, the individual may be looking to erase personal data (right to erasure) or amend incorrect personal data (right to rectification), as well as receiving a copy of their personal information.
Is the individual requesting the information who they say they are?
I know it can be tempting to just assume the person is who they say they are, but you need to follow procedure, otherwise you could find yourself giving someone unauthorised access to information that's not theirs.
You will need to ask for a recent utility bill or a photographic identification to verify their identity. It is best to stick with passports and licenses as the main form of photographic identification.
If the person requesting the information is your employee, you don't need to verify their identity assuming you already have their identification.
Also, only ask for the information you need and nothing more.
Each subject access request is different and there isn't one answer for every single request. This means you need to dive into each request individually:
Every folder you have lying around the office, every electronic folder on your system and anywhere else you could have client data, will need to be searched to identify the information of the individual in question.
The data provided needs to be from the original record but you don't have to give the original record to the individual.
Identifying what data to leave out is incredibly tricky, but crucial. For instance, you could be sending an individual somebody else's data and this would go against the Data Protection Act.
Another instance where you are required to retain information is when it is in the public and government's interest to withhold the data and also when it can interfere with a legal investigation.
This is completely tailored to the individual as it depends on the context at hand so you need to handle this situation with care and take your time with it.
You need to match the response with the format of the subject access request unless the individual has stated otherwise. For instance, if the individual has made the request electronically then you need to send them the response electronically.
You should always record what you're doing, you need to protect your organisation and be able to prove when you are in the right. By noting down the decision-making process of the entire procedure, you can provide evidence if you ever receive a complaint.