Table of Contents
How long does the council have to respond to data protection requests?
Under the data protection laws, organisations must respond to SARs without delay, and within one month.
On what grounds can SAR be refused?
You can also refuse to comply with a SAR if it is: manifestly unfounded; or. manifestly excessive.
Can a data request be refused?
You can refuse requests if they are repeated, whether or not they are also vexatious. You can normally refuse to comply with a request if it is identical or substantially similar to one you previously complied with from the same requester.
What is exempt from a subject access request?
An exemption applies to personal data that you process for management forecasting or management planning about a business or other activity. Such data is exempt from the right of access to the extent that complying with a SAR would be likely to prejudice the conduct of the business or activity.
How far back can a SAR request go?
You must get back to the individual with the requested information without undue delay. However, you can extend this time period to up to three months if the request is complex, or if the same individual has made a high number of requests.
Can the police request personal data?
2 Data Protection Act 2018. The police and other agencies can request access to personal information held by local authorities for specified purposes.
What happens if a SAR request is ignored?
If an organisation ignores a subject access request or does not provide all the personal data held, the individual can complain to the ICO. The ICO can then issue an enforcement notice requiring the organisation to take certain action in the event of a breach of the law. Failure to comply is a criminal offence.
What is an example of sensitive data?
Sensitive data examples: Genetic or biometric data. Mental health or sexual health. Sexual orientation. Trade union membership.
What happens if a company ignores a subject access request?
What if a company doesnt respond to a SAR?
If you’ve complained to an organisation and you still do not receive any response, or remain unhappy with their handling of your subject access request, you can make a complaint to the ICO.
What happens if a company does not comply with a subject access request?
If you fail to comply with a SAR, the requester may apply for a court order requiring you to comply. It is a matter for the court to decide, in each particular case, whether to make such an order.
Can you refuse a SAR request?
Can we refuse to comply with a SAR? The ICO guidance says that you can only refuse to comply with a SAR where it is manifestly unfounded or excessive, taking into account whether it is repetitive. If you conclude you do not need to respond, you must to be able to justify your decision.