Complying with Data Subject Access Requests

Gain a brief overview of Data Subjects Access Requests, under GDPR and Data Protection Act 2018.

• Ascertain what the GDPR and DPA Act 2018 say about SARs
• Gain a better understanding of the ICO’s right of access guidance
• Learn how to reconcile conflicting legislation
• Understand the reduced time frames
• What personal information is covered

• Ensure the subject access request is valid
• Train your staff to identify a SAR
• Prepare your staff to take a SAR through different mediums: phone, email, letter or form
• Gain senior buy-in to ensure your organisation has effective procedures in place to manage SARs
• Develop strategies to manage the increase of SARs
• Learn the tools to verify the data subjects identity
• Establish proof of authority

• Understand the exemptions in the DPA Act 2018
• Identifying and managing vexatious requests
• Understand how to conduct a public interest test
• Know what information to include in a refusal notice
• Understand what tools are available for managing SARs

• Trainer will review the day’s learning and the next stages of the course
• Delegates will have time to ask questions and share views with one another

How to deal with requests for personal data relating to third parties without harming individual’s rights.

• Data protection considerations
• The public interest factors
• Sensitive personal data
• Establish what information should never be disclosed

• The role of a Data Protection Officer in managing a SAR
• Examine bad and best practice examples
• Learn what information to include when responding to a SAR
• Avoid data breaches by removing other individual’s data
• Develop recording procedures to monitor the process of the SAR request