UK GDPR & Subject Access Requests - Everything You Need to Know

Introduction

More than 40% of complaints to the Information Commissioner’s Office (ICO) each year relate to subject access requests and the ICO has now adopted a ‘name and shame’ approach whereby it issues public reprimands to controllers found to be in breach.

Being able to deal with such requests in a compliant fashion is therefore essential for controllers.

This 1-hour e-learning programme summarises the key content of the ICO’s guidance as well as discussing enforcement examples and recent decisions of the courts in this area.

A series of practical steps to take will also be outlined.

What You Will Learn

With interactive learning activities, knowledge checks, and key reminder messages, the programme covers the following:

Summary of the ICO’s Guidance

• Provision of information requirements
• Meaning of ‘manifestly unfounded’ or ‘excessive’
• Timing requirements - when is a request time consuming or complex?
• Fees - can they be charged and for what?
• Clarification - can this be requested and how does this affect the time period?
• Exemptions - what are they and how should they be applied?
• Third party rights - how should third party data be dealt with?

Lessons from Recent Case Law

• Motivation of the request - to what extent is this relevant?
• Application of the legal professional privilege exemption
• Unstructured filing systems - how will the courts determine this issue?
• Documents or data - what is the data subject entitled to receive?

You can take each section at your own pace, picking up where you left off and are able to see your progress throughout.

The programme concludes with an assessment. Your score will be recorded and 'super-user' reporting functionality for the organisation as a whole is available in the MBL learning platform.