Julie Duane, Solicitor Advocate at CG Professional.
Following the introduction of the General Data Protection Regulations 2018, employers will be aware that there have been changes to how Subject Access is processed, however, a question which requires further clarity and understanding is when does the clock start running on a request?
The ICO’s position
The Information Commissioner’s Office (ICO) has recently updated it guidance in respect of Subject Access Request (SARs) and the time limit for responding to them in accordance with section 45 Data Protection Act 2018.
The ICO has helpfully clarified that the time limit to respond to a SAR, in accordance with section 50 DPA 2018, takes effect the day you receive the request. This means that the day of receipt starts the clock as “day 1” for processing the request. For example, a request received on 10 November should be responded to by 10 December. This is to be read in conjunction with section 54(3). Details of the notice is as follows: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/08/timescales-for-responding-to-a-subject-access-request/
In order to take into account, the recent update from the ICO, employers should ensure that they amend their policies and procedures to ensure that they are acting in accordance with the ICO guidance.
If you have any questions regarding this article or an alternate query, please do not hesitate to contact a member of the CG team who will be more than happy to assist.