On May 24, 2023 (or as we like to call it, the eve of GDPR’s 5th birthday), the UK’s data protection body, the Information Commissioner’s Office (the ICO), published a new guide for employers on responding to data subject access requests (DSARs).

When publishing the guidance, the ICO noted that it received over 15,000 complaints regarding subject access in the last year and failure to comply with a DSAR was the most frequent reason that people complained to the ICO, making up around a third of all of the complaints.

Failing to comply with a DSAR can result in fines or reprimands as well as reputational damage, so it is important that organizations get it right. We are also increasingly seeing failure to comply with DSARs being cited as a complaint in employment litigation.

What are DSARs?

The right of access gives individuals the right to request a copy of their personal information from organizations. Organizations must respond to a DSAR within one month of receipt of the request although this timeframe can be extended by up to a further two months if the DSAR is complex or if the employee has sent a number of requests.

DSARs have become a strategic tool for employees attempting to gain information, often during a dispute or grievance process. Employers must strike a balance between upholding employees' right of access, protecting sensitive corporate information, protecting other individuals’ data and applying legal exemptions in an appropriate way. As many employers have...

Read Full Story: https://news.google.com/rss/articles/CBMidWh0dHBzOi8vd3d3LmxpdHRsZXIuY29tL3B1...