UK ICO Publishes New Guidance on Subject Access Requests

On
May
24,
2023,
the
UK
Information
Commissioner’s
Office
(“ICO”)

announced
it
published
new

guidance
for
businesses
and
employers
on
responding
to
subject
access
requests
(“SARs”).
The
right
of
access,
commonly
referred
to
as
a
subject
access
request,
gives
someone
the
right
to
request
a
copy
of
their
personal
information
from
organizations.
The
ICO
received
over
15,000
complaints
related
to
SARs
during
April
2022
and
March
2023.

The
new
guidance
aims
to
provide
information
on
the
key
requirements
to
comply
with
a
SAR,
and
to
answer
questions
commonly
asked
by
organizations,
particularly
employers,
when
handling
SARs.
For
example,
the
guidance
discusses:
whether
clarifications
can
be
sought
from
the
requester
of
the
SAR;
when
information
can
be
withheld
when
responding
to
a
SAR
and
the
relevant
exemptions
that
may
apply;
and
specific
scenarios
which
often
arise
when
handing
SARs,
such
as
when
the
individual
is
copied
into
an
email,
whether
searches
should
be
conducted
on
social
media,
and
the
use
of
CCTV
footage.  

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts