Earlier this year we published a post on our blog about Subject Access Reports and the onerous obligation they are for organisations, especially smaller business that have limited resources to deal with such time-consuming tasks. Over the last few months, our website statistic show that post has become one of our most popular and the number of views has skyrocketed.

In that post, we gave some advice about what organisations could do to manage their data and so minimise the impact of a SAR if one was ever received. However, someone at the Information Commissioner’s Office (ICO) must have read it too because just last month new guidance was released about the handling of SARs that could take out some of the sting for employers.

We’ve been unable to find any statistics that might explain why that particular post has become so popular but we have a theory that it’s because there has been an increase in the number SARs received by employers. This we think is in response to individuals losing their jobs during the Covid-19 pandemic and wanting either to establish why they were selected for redundancy or just to be a nuisance to their former employer.

With more and more information being held electronically and more communication taking place via digital means, the potential amount of work involved in responding to a SAR is only going to increase. This makes the new guidance from the ICO particularly timely and should be welcomed with open arms.

The guidance in its entirety is quite a piece of bedtime reading but the pertinent points for employers are that:

• When a Subject Access Report is received, it is perfectly just and reasonable to ask the requester to clarify what information they are looking for, the context of the information or a timeframe within which the information might be found
• Whilst clarity is being sought, the clock is stopped on the time the employer has to respond to the SAR, thereby extending the usual 30 days

This new guidance is significant because it now puts some onus on the requester to be specific about the information they are looking for. This will potentially stop disgruntled employees from using a SAR as a weapon of revenge by forcing their former employers to incur unnecessary expense of time and money in preparing it.

Here’s an excerpt from an example on the ICO’s own website:

A supermarket receives a SAR from a long-standing employee for all the data the supermarket holds about them. The employee has recently had a complaint made about them by another employee.

The supermarket asks the employee if they only want information relating to the complaint or if the employee is looking for information between particular dates. The supermarket also asks if the employee would like information unrelated to their employment, eg information linked to the employee’s reward account as a customer.

Until the supermarket receives clarification, they will be unable to perform a reasonable search, or provide a copy of the information, as they do not know what information the request relates to.

You’re welcome to read the guidance on the ICO website at https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/right-of-access/ but in the meantime our original post is still very relevant and the advice it gives in managing and handling individuals’ information still deserves to be taken note of to help minimise any future liability. As usual however, all cases should be dealt with on an individual basis so please pick up the phone or drop us an e-mail if you’re ever in any doubt.

Call us on 01452 331331 or e-mail This email address is being protected from spambots. You need JavaScript enabled to view it.