Responding to Data Protection Complaints

Ramsdens Solicitors regularly advises organisations on compliance with all aspects of data protection law. Our experienced legal specialists can assist at every stage of these often complex legal cases, including how to respond to data protection complaints and Subject Access Requests (SAR).

Our experienced solicitors can guide you through the process and help you to respond appropriately, within the legal timeframe, taking the pressure off you at a time of uncertainty.

Contact Ramsdens Solicitors today by calling 01484 821 500 or fill out an online enquiry form, and we will be in touch at a time that is suitable for you.

How we can help

Our specialist solicitors help businesses respond to Subject Access Requests, particularly in complex cases or those involving contentious issues. For instance, we have assisted firms in this area when a request has been made by a former employee or within the context of an ongoing legal dispute.

In many cases, the data being requested is wide-ranging or difficult to uncover, and you may be unsure what information should and should not be disclosed in accordance with data protection law.

Our solicitors also offer advice in relation to data breaches, while advising organisations about civil claims that have been brought against them as a result of a breach.

We will guide you through the legal process should you find yourself under investigation by the Information Commissioner’s Office (ICO).

FAQs

What is a Subject Access Request (SAR)?

Organisations hold a certain amount of information on individuals that is used or stored. Individuals are able to ask for a copy of this data, in the form of a SAR, to ensure that what is being held on them is in keeping with the law.

SAR's can be made verbally, electronically (including using social media) or in writing.

How long do I have to process an SAR?

You are legally required to respond to the SAR within one month after receiving it. This can be extended to two months if the request is particularly complicated or if you have received numerous requests.

You should let the individual asking for the information know about this extension within one month.

What information do businesses need to provide?

You should provide as much as you can, based on the request you have received. This could include:

• Copies of statements held under their account number
• What you are using their data for
• Who their data has been shared with
• Information on where their data comes from
• Information on their right to challenge the accuracy of the data

It is important to note that the request does not need to include the words ‘subject access’ or refer to the Data Protection Act to constitute an SAR.

How do I display a response to an SAR?

The information needs to be provided in a commonly used format, such as an electronic document. However, it does not need to be presented in this format if it would take ‘disproportionate effort’, or if the applicant has asked for it in a different format.