Privacy & Cybersecurity Law Blog

On May 24, 2023, the UK Information Commissioner’s Office (“ICO”) announced it published new guidance for businesses and employers on responding to subject access requests (“SARs”). The right of access, commonly referred to as a subject access request, gives someone the right to request a copy of their personal information from organizations. The ICO received over 15,000 complaints related to SARs during April 2022 and March 2023.

The new guidance aims to provide information on the key requirements to comply with a SAR, and to answer questions commonly asked by organizations, particularly employers, when handling SARs. For example, the guidance discusses: whether clarifications can be sought from the requester of the SAR; when information can be withheld when responding to a SAR and the relevant exemptions that may apply; and specific scenarios which often arise when handing SARs, such as when the individual is copied into an email, whether searches should be conducted on social media, and the use of CCTV footage.