Data Subject Access Requests in the UK: The Extent of the Obligation

May 23, 2012
Dealing with a data subject access request (SAR) served by an individual, whether or not that person is an employee, pursuant to section 7 of the Data Protection Act 1998 (DPA) can be a very time-consuming process for an employer. This update reports on a recent County Court decision that suggests an employer’s (or other data controller’s) search for personal data need only be proportionate — and that a SAR cannot properly be made only for the purposes of actual or contemplated litigation.