MANAGEMENT
HANDLING A SAR
Are You Ready For a SAR? A subject access request can lead to stress levels skyrocketing, but it doesn’t need to be the cause of anxiety REBECCA CUNLIFFE explains why
H
ave you received a SAR? Have you been surprised or shocked by the data uncovered? Training your staff and giving them an understanding that their data/communications will come up in a search is important, so that they can ensure they have always acted professionally when using any communication systems. As a school business leader, you will be involved at some level - so let’s go through what staff need to know about the process and the potential pit falls when dealing with a SAR. Hopefully this will make your life easier when one lands on your desk. GETTING A REQUEST Anyone can submit a Subject Access Request (SAR) under the Data Protection Act 2018 and UK General Data Protect Regulation (GDPR). The request is made by an individual to access all the personal data held on your systems digitally and in paper form about them. We know these requests usually come from disgruntled individuals looking for specific information, none the less we must provide everything we hold and within a specific timeframe. Time spent now training and ensuring your
28 September/October 2024
establishment has ‘clean’ data will save you a lot of stress later. Imagine that you have received a request (or to reflect on a SAR you have dealt with) - think about the types of information we hold and people we hold this for - parents, students, employees, contractors etc. What information do you hold and are you happy to share this? It is also useful to understand your role in the process, are you the Data Protection Officer (DPO) or the Information Manager (IM)? If you are the DPO, you are responsible for ensuring that the statutory and regulatory obligations with respect to the GDPR are adhered to. If you are the IM, you are responsible for handling the SAR. Requests can be submitted in writing, verbally and through social media and there is no specific format that individuals must use to make this
request. Firstly, you should verify the identity of the person making the request. When sending information, you are sharing personal and sometimes sensitive information so making sure, from the outset, that the person you will be sharing this with is the person they say they are is crucial. You can request copies of their passport, driving licence or birth certificate plus proof of address to confirm their identity. It is worth taking time in these early stages to speak directly to the person making the request to clarify what it is they want. They may only want one or two specific documents. Make sure this is clear and ensure they would be happy to only receive copies of the named documents, this could save you a lot of time. GATHERING THE INFORMATION This is where you find out everything and anything that is held on your