The principle that people have rights to access the data you hold about them is nothing new and has been a feature of data protection law since the Data Protection Act 1984: you should already be prepared to handle such requests.
If you are currently faced with a Subject Access Request (SAR) and need help to carry it out, then we can help, but you should act quickly. You must comply with a SAR “without undue delay” and (unless the request is complex) at the latest within one month of getting the request – so we actually recommend turning these around within 20 working days.
Our Subject Access Request Service can help you to:
- Recognise a subject access request and record it in an appropriate way
- Verify the identity of the requester to ensure it is genuine.
- Ask for clarification (if required) and pausing the SAR timer until the clarification is received.
- Determine whether to refuse a request if it is manifestly unfounded or excessive.
- Identify locations where data may be stored, these can be
- digital (e.g. computer files)
- analogue data (e.g. in a filing system)
- Identify exemptions that may be relevant.
Once these steps have been taken, we can help you by:
- Running discovery tools to search for specific data items such as individual emails or files including:
- Office files (Documents, Spreadsheets, Presentation)
- Emails and attachments
- PDFs and text files
- Scanned documents and images
- Structured and unstructured data sources
- Collecting that data into a central location for processing, including:
- Intelligent identification and redaction of sensitive information
- Automatic detection of third-party Personally Identifiable Information (PII)
- Consistent redaction across all document formats
- Quality control measures to prevent accidental disclosure
You can be confident in our services:
- Decades of Data Protection Experience
- Up to date training on UK GDPR.
- An end-to-end tracking of SAR requests form start to finish.
- A systematic approach to data recovery.
- A clear workflow to ensure robust compliance checkpoints and timely responses.
- Regular status updates and reporting.
How much does this service cost?
The cost of handling a Subject Access Request varies considerably from case to case. Responding to requests that have very specific parameters are straightforward to conduct, so might take a day or two and are likely to cost under £1000. Complex requests that involve multiple systems, paper records, and extensive redaction work may take hundreds of hours and could cost several thousands of pounds. In order to give you an idea of price we’ll need to do a chargeable assessment and subsequent quote.
Get Started
For immediate support with your Subject Access Request, call us on 01603 554000 and speak to one of our Redaction Support Specialists. We’re happy to have a quick chat to discuss your needs but in order to give you a quote we’ll have to understand the scope of the SAR and where the data might reside. A chargeable assessment is typically required to make this so.
How do I make future Subject Access Requests cheaper?
Implementing robust data protection policies and retention procedures can significantly reduce the burden of future SAR requests. By regularly reviewing and managing the personal data you hold, you can minimise both the complexity and cost of responding to Subject Access Requests.