Subject Access Request
Subject Access Request
Under Data Protection legislation, a data subject has the right to ask an organisation for access to and copies of any personal data held about them. In Data Protection terminology, the data subject is the individual about whom personal data may be held.
This procedure is called a Subject Access Request (SAR)
The following applies to SARs:
- data subjects may only request information about themselves.
- proof of identity from the data subject is required (photographic ID such as a passport, drivers licence, student card etc.).
- a third-party, such as a lawyer, may submit a SAR on behalf of a data subject, subject to their written consent.
- there is a one month response timescale for SARs, however this can be extended to three months in certain circumstances (e.g. where the request is complex).