Subject Access Requests: What To Do and Why You Should Care

Imagine you’ve been promoted. You’re ecstatic on your first week of your new job and nothing can bring you down.  

You get an email from a former colleague, someone that was passed over for this promotion before bitterly moving to a new job. They ask to see all the emails and Teams messages where you’ve talked about them behind their back. Fat chance I’m sending them that, you think before closing the email. 

What you haven’t realised is that the email may constitute a Subject Access Request and, if so, a clock has started ticking. Ignoring such an email could mean the University fails its legal obligations.  

Subject Access Requests (SARs) are a right under UK GDPR, and a request that does not mention “Subject Access”, “SAR” or “data” can still be valid. They grant individuals the ability to view Personal Data that an organisation holds on them, subject to limitations and exemptions, especially where their request clashes with the rights of others. 

So, what should you have done? 

If you are asked to give someone access to their Personal Data, beyond any routine request, you must immediately forward the entire request to the Data Protection team.  

This is true regardless of what the request is for and how it is delivered. It doesn’t matter if the request is for CCTV or attendance records, whether it’s been delivered verbally, by pigeon or by Instagram direct message, you must contact dataprotection@bath.ac.uk 

Don’t hesitate since the University has a responsibility to fulfil a SAR without undue delay, generally within one calendar month from the moment a request is submitted. 

What will be checked? 

Depending on what Personal Data is requested and what is reasonable and proportionate, Teams messages, emails, documents, or CCTV footage may all be checked. However, this does not mean full documents will be shared, people are only entitled to their data with other Personal Data redacted. 

While personal devices and external platforms such as WhatsApp will not be checked by the Data Protection team, work data on such devices are in the scope of a SAR and using these to deliberately conceal data from SARs could constitute a criminal offence.  

If you are concerned about a specific SAR or are considering putting in a request yourself, please schedule a confidential call with the Data Protection team. 

If the Data Protection team contacts you 

Even if you did not directly receive the SAR, the Data Protection team may contact you to ask for an individual’s Personal Data, and you must supply everything necessary. 

It doesn’t matter if the messages or documents are embarrassing or easily misinterpreted, it must ALL be provided as only the Data Protection team is authorised to decide if legal exemptions apply. If you spot mistakes in the data, you can correct this as long as you provide a copy of both the incorrect and the corrected data.  

Combing through emails or documents may be extremely time consuming and complex, but people don’t submit SARs for fun. They may need this data for a visa application, to show their parents that they have been studying, or simply to give them the assurances that the University processed their data fairly and lawfully; you just don’t know how important this could be to someone. 

Too long, didn’t read 

• A Subject Access Request (SAR) allows individuals to view the Personal Data that an organisation holds on them. This is an individual’s right under UK GDPR, but it is subject to limitations and exemptions, especially if it clashes with other people’s rights. 

• An individual can request their Personal Data in a verbal or written format – and without even mentioning SARs or data – to anyone in the organisation. 

• As soon as you receive, or think you receive, a SAR, forward it in its entirety to dataprotection@bath.ac.uk  

• You must comply with our Data Protection team on a SAR and not withhold Personal Data or use WhatsApp or other external channels to conceal it from a disclosure. 

• You are welcome to arrange a confidential call with the Data Protection Officer if you are concerned about a request, if you are considering making a request yourself, or if you have any other questions, suggestions or concerns about Data Protection.