Subject Access Requests: Your Right to Know

In an era where data is considered a valuable asset, transparency regarding how that data is collected, stored, and processed has become a fundamental human right. One of the most powerful tools provided by modern data protection legislation, such as the General Data Protection Regulation (GDPR) in Europe and similar laws globally, is the Subject Access Request (SAR).

What is a Subject Access Request?

A Subject Access Request is a formal request made by an individual to an organization, asking for access to the personal data that the organization holds about them. When you make a SAR, you are effectively asking a company or institution to "show you what they know" about you.

Who Can Make a SAR?

Any individual, regardless of their nationality or place of residence, can submit a SAR to any organization that processes their personal data. This applies to employers, banks, healthcare providers, social media platforms, and government agencies. Furthermore, individuals can also authorize third parties, such as legal representatives or family members, to make a request on their behalf, provided there is appropriate authorization.

How to Submit a Request

There is no specific legal format required to submit a SAR. You can make the request verbally or in writing. However, for the sake of clarity and record-keeping, it is highly recommended to submit requests in writing, preferably via email, so that there is a timestamped trail of the correspondence.

To ensure a smooth process, you should provide sufficient information to help the organization identify you, such as your full name, account numbers, or previous addresses. Organizations are permitted to ask for reasonable proof of identity before releasing sensitive personal information to protect your security.

The Organization's Obligations

Once a valid request is received, the organization must act within specific legal timeframes. Under the GDPR, for example, the organization must respond "without undue delay" and at the latest within one month. If the request is complex or numerous, this period can be extended by two further months, provided the requester is informed of the delay and the reason for it.

Generally, responding to a SAR must be free of charge. Organizations may only charge a reasonable fee if the request is "manifestly unfounded or excessive," particularly if it is repetitive in nature.

Limitations and Exemptions

While the right of access is broad, it is not absolute. Organizations are not required to provide data if it adversely affects the rights and freedoms of others, such as trade secrets or intellectual property. Furthermore, information that identifies other individuals (third-party data) may be redacted or withheld unless the other individual has consented to the disclosure or it is reasonable to comply without that consent.

Why Do People Make SARs?

Individuals exercise their right to access data for various reasons:

• Correction: To ensure the information held by an organization is accurate and up-to-date.
• Transparency: To understand how an organization is using their profile for marketing or profiling.
• Legal Disputes: To gather evidence for employment tribunals or civil litigation.
• Curiosity: To understand the digital footprint they have left behind with a specific service provider.

Conclusion

The Subject Access Request is a cornerstone of digital autonomy. By exercising this right, you shift the power dynamic back in your favor, ensuring that those who manage your information remain accountable and transparent. If you believe an organization is holding incorrect data or you simply wish to review your digital history, do not hesitate to reach out to their Data Protection Officer and initiate a request.