Getting SARs Right is essential to compliance. When the 2018 Data Protection Act established that SARs could be made free of charge and could be raised verbally, there was an expectation of a rapid increase. The increase didn’t happen straight away, but we’re now seeing the significant increases. We’ve heard of requests running at up to four times the rate of last year and organisations that had never received request are starting to see than. DPT, help with getting SARs right.

SARs: Free to the individual, not the organisation

Contact
Stage 1
Receiving the initial request, dealing with identity, eligibility and the details of the requirement
Extract
Stage 2
From the criteria given, data must be retrieved from databases, emails, online documents and manual filing systems.

Extract
Compact
Stage 3
Between false positives and duplicates, you’ll get more data than you need. Time spent compacting the information now will more than pay off when you come to redact.
Redact
Stage 4
The most complex stage, working out competing claims to data and the application of exemptions. Then prepare the information for release.

Redact
Product
Stage 5
The completed data must be delivered to the requestor along with the necessary information. Queries raised must be dealt with

The average SAR is estimated to cost between £3,000 to £6,000 to fulfil

Source: Statista

Getting SARs Right

SARs could be raised verbally and became free of charge with the 2018 Data Protection Act. There was an expectation of a rapid increase, but in contrast, this didn’t happen straightaway. However, we’re now seeing a significant growth in requests. We’ve heard of requests running at up to four times the rate of last year, and also of organisations seeing requests who have never received them previously. As a result, getting SARs right first time is more important than ever.

We can provide support for any of the blocks in the process. Costs are based simply on the amount of time that it takes to provide the support. We are happy to review the likely size of a task and provide a quotation. Providing the initial information is accurate then we’ll stick to that quoted price.

Want to see what the ICO advises?

Data Protection Helpdesk, on hand when you need it.

Stage 1: Contact with the requestor

Beginings can be difficult. Very few people submit a SAR without some underlying purpose. We generally see two core purposes for requests. Firstly, to provide evidence for a process that is going on elsewhere, for example supporting the production of an Education Health Care Plan. Alternatively the individual has some dispute with your organisation and they are looking to support their position. This means that very often the SAR is made against a background of conflict or strong emotions.

We can help you ensure that requests are dealt with in a consistent, high-quality manner. We can support you to make the decision about whether the request can be actioned. Furthermore, we can take on the task of dealing with a requestor on your behalf. This representation can be particulalry useful where the relationship with the requestor is difficult.

Get in Touch

Magnifying glass focused on technology chip, research, blue theme

Stage 2: Extract the raw data

Once you’ve completed the tasks of confirming the identity of the requestor and ensuring they have a right to the data, you need to get the information assembled. It’s worth remembering that SARs often come up in already difficult situations. You need to be sure you can show you’ve collected all the personal data required.

We can help you make efficient searches and get clarification from the requestor on exactly what they require. You’ll likely have to work across emails, online documents, dedicated systems and often paper records. In conclusion, having the right data is essential to getting SARs done.

If we’re doing the redaction then well ask for emails and documents in thier original applications, other documents in pdf. Hard copy documents should generally be scanned to pdf. Converting everything to pdf at this point can significantly slow down the rest of the process.

Get in Touch

Stage 3: Compact the data

There are three things we need to consider at this stage. Is the data actually related to the individual, is the data a duplicate of something already included and is the data subject to an exemption? We only want to move the minimum amount of data to the redaction phase.

Our experts can quickly review the data in emails, or documents, and consequently rule them in or out for redaction. This part of the process can reduce the number of pages requiring redaction from several thousand to just a few hundreds. When dealing with files like spreadsheets, the approach is to remove all data that doesn’t relate to the data subject.

Even if you plan to do the redaction yourself, we can save you hours, or days of work. We can make large SARs manageable.

Get in Touch

Stage 4: Redact the data

Now comes the hard part. SAR’s most often arise when there is some sort of dispute or grievance. Requestors often want communications between other individuals that that relate to a specific incident or concern. We must ensure that the requestor gets the appropriate information and only the appropriate information. In other words, the requestors’ objectives are not relevant in deciding what data they will receive.

Our expert team can redact efficiently and accurately. They provide a summary of decisions that have been made, especially where the complex ones. In highly complex cases you may be asked to discuss options. We can provide secured redacted files or, if required, host them for the requestor to download them securely.

Get in Touch

Data Protection Helpdesk, support you need when you need it.

Stage 5: Deliver the results

The requestor downloads the results of the SAR as a password protected file, in most cases. In some cases after the results are delivered the request is complete. For some requestors, in contrast, the delivery of results is the start of a lengthy process. Individuals are often unhappy with the results of a SAR when thay made it to try and collect evidence.

As independent consultants, focused on the integrity and accuracy of the data, we can help to take the emotions out of these situations. We are also very experienced dealing with legal teams and if needs be the ICO.

Get in Touch

Data Protection Training, for individuals or organisations, standard or bespoke courses as you need. Contact us to find out more.

Process considerations

Complaints about the responses to subject access requests are quite common. Requestors frequently have underlying which lead them to make the request in the first place. As a result, complaints often find their way to the Information Commissioner’s Office. You may find yourself having to justify the actions you have taken and the decisions made to produce the response.

You need to be able to show each step of your process, from dealing with the requestor, clarifying any uncertainty in the request and the specification for the data extract. Similarly, If you don’t extract data from some systems, you need to be able to explain why.

Finally you need to be able to explain the choices made during the redaction process.There are other parts of the process that need to managed in an efficient fashion, for example, communication with the requestor especially if you are seeking clarification, or notifying of an extension. Handled incorrectly these factors can leave you on the back foot and open to more avenues for complaints.

Get in Touch

SARs: Free to the individual, not the organisation

Contact

Stage 1

Extract

Stage 2

Extract

Compact

Stage 3

Redact

Stage 4

Redact

Product

Stage 5

The average SAR is estimated to cost between £3,000 to £6,000 to fulfil

Getting SARs Right

Want to see what the ICO advises?

Stage 1: Contact with the requestor

Stage 2: Extract the raw data

Stage 3: Compact the data

Stage 4: Redact the data

Stage 5: Deliver the results

Process considerations

Legal

Navigation

Categories