Outsourced Data Subject Access Request Specialists...

The ICO state ‘Where you can, you should give a person the data they’ve asked for in a subject access request. It’s very unlikely that you’ll be able to refuse a request altogether, but it’s possible in certain situations such as if the request is excessive. If you decide to refuse all or part of the request, you should note your reasons why. This is because you need to be able to justify refusing a request.

A request could be considered excessive if it repeats or overlaps other recent requests. However, a request isn’t excessive just because a large amount of data has been asked for. In these cases, you can ask the person to narrow their request. If they choose not to, you’ll need to carry out reasonable searches for all the information.

Another possible situation in which you might be able to refuse a subject access request is if it’s unfounded or unreasonable. This can be where you have reasonable grounds to believe the person making the request has no real interest in obtaining the information they’ve asked for, and is only making the request to harass or cause expense to your business.’

The ICO state ‘Most of the time, you should avoid disclosing information about other people. But there may be occasions when the personal data you’ve pulled together includes information that’s closely linked to someone else. In those situations, your aim should still be to release the personal data requested. But you also need to think about what might happen if you disclose data about someone else.

First, you should check to see if you need the other person’s consent to provide their information. If you don’t have the consent of the other person, then you should think about whether it’s reasonable to provide that information without their consent. You need to bear in mind any duty of confidentiality you have to them. You also need to think about what kind of information might be disclosed, as some information might be particularly sensitive. If you can’t get consent and it’s not reasonable to provide the information without it, then you should see if you can redact the other persons information.  You should look to disclose personal data if you can but it’s a balancing act in these circumstances.

The ICO state ‘The organisation you’re dealing with must respond as quickly as possible. This must be no later than one calendar month, starting from the day they receive the request. If the organisation needs something from you to be able to deal with your request (eg ID documents), the time limit will begin once they have received this.

If your request is complex or you make more than one, the response time may be a maximum of three calendar months, starting from the day of receipt.’

• Expertise: Third-party providers specialise in handling subject access requests (SARs), ensuring compliance with privacy regulations (e.g., GDPR, CCPA).
• Efficiency: Outsourcing reduces the time and resources needed by internal teams, enabling quicker responses to requests.
• Cost Savings: Outsourcing can be more cost-effective than hiring and training in-house staff, especially for periodic or fluctuating SAR volumes.
• Scalability: External service providers can handle large volumes of requests during peak times, offering flexibility.
• Risk Mitigation: Third-party vendors such as Content Capture Services can help reduce the risk of non-compliance or mishandling of sensitive data, with established processes in place.
• Focus on Core Business: Delegating SAR processing allows internal teams to focus on core business functions, improving overall productivity.
• Data Security: Professional SAR handling services implement stringent data protection measures to ensure the confidentiality and security of personal data.