Changes to Subject Access Requests under GDPR
The importance of understanding the changes to Subject Access Requests
Subject Access Requests are nothing new and have been part of the Data Protection Act 1988 (DPA) since it was formed. In line with GDPR going live, from 25 May 2018 a new Subject Access Request regime will come in to force with changes being made to the current format. The following article outlines the main changes employers need to be aware of to remain compliant and avoid any penalties.
Complying with legislation is vital for a business to succeed because failure to comply can result in hefty fines that can ultimately cost too much for the business to continue trading. At Lawson-West our employment team pride themselves on their knowledge of employment law and can advise businesses on the areas that require compliance and what needs to be actioned to be compliant.
Subject Access Requests entitle individuals to the right to find out what personal data is held about them by an organisation, why the organisation is holding and who their information is disclosed to by that organisation. This is an important part of the GDPR guidance which is advising businesses to be as open and transparent about their data processing and falls in line with the changes to SAR’s also.
The changes to Subject Access Requests (SARs)
There are going to be several changes to Subject Access Requests that employers need to be mindful of going forward.
Response Time
An employer has previously had 40 days to repose to a SAR. Under GDPR, the timescale will now be ‘without undue delay and in any event within one month of receipt of the request’. GDPR does allow employers to extend the deadline up to two months where requests are particularly complex, the individual must be contacted within one month of the request and notified of the delay. The more specific the individuals’ request, the easier the request will be to process.
Charges
It is currently acceptable to charge a fee of up to £10 to process a Subject Access Request but under GDPR this fee will be scrapped, and the information must be provided free of charge, however there are exceptions. If the request is deemed ‘manifestly excessive or unfounded’ an employer can charge a fee, the fee must be based on the amount of administration the request requires.
The right to refuse
In addition to being able to charge for ‘manifestly excessive or unfounded’ request, employers will also be able to refuse to respond to unwarranted requests. The employer must be able to justify the refusal and explain to the individual their right to complain and take the matter further.
Access
When the new regulations come into force, it must be possible for employees to make SARs electronically and unless otherwise requested by the individual should be provided in a commonly used electronic format. The changes also include the ability to make requests via the company’s social media sites, organisations can steer people towards a particular communication channel, but may not insist on it.
The right to withhold personal data
Under GDPR organisations can withhold personal data if disclosing it would adversely affect the rights and freedoms of others.
If an employer fails to meet the deadline or provide an employee with access to all the data they request it could expose the organisation to significant penalties.
Lawson-West’s understanding of the changes
If you are unsure on the impact GDPR compliance has in regards to your employees why not join us at our event on Friday 4th May where we will be discussing this subject. Our employment law team will be delivering the session; it is an open forum for like-minded businesses to share their ideas on how they are approaching the matter. Reserve your place today.
Alternatively if you find yourself in a situation where you need employment law advice please remember there are strict time limits in Employment claims where you should take good advice as soon as possible.
With offices in Leicester, Wigston and Market Harborough we are willing to discuss your employment dispute at any of our offices. In addition we are a national provider of expert employment law advice and welcome a free discussion with you regarding you circumstances and potential claim. If you believe you have a situation where you require free legal advice, please contact us on telephone either 0116 212 1000 or 01858 445 480.
View all
