The Information Commissioner’s Office (ICO) has revised its guidance regarding timescales for compliance with Data Subject Access Requests (DSARs) where the data controller requires further information from the data subject.
The new guidance will certainly not be welcomed by employers, as now the clock starts ticking from receipt of the DSAR, or (if later) the receipt of proof of identification. It is not paused if an employer asks the data subject for more information (timeframes, keywords, individuals involved etc.) in order to understand the nature and scope of their request.
This change applies to both the one- and three-month time periods for compliance (the latter applying for more complex requests). The data subject must also be made aware of an extension within the first month after their request.
While employers can, and in many situations still should, ask the data subject for further information to clarify what information they are seeking, this change will inevitably lead to a reduced timeframe in which businesses must collate their responses.
Dentons is the world's first polycentric global law firm. A top 20 firm on the Acritas 2015 Global Elite Brand Index, the Firm is committed to challenging the status quo in delivering consistent and uncompromising quality and value in new and inventive ways. Driven to provide clients a competitive edge, and connected to the communities where its clients want to do business, Dentons knows that understanding local cultures is crucial to successfully completing a deal, resolving a dispute or solving a business challenge. Now the world's largest law firm, Dentons' global team builds agile, tailored solutions to meet the local, national and global needs of private and public clients of any size in more than 125 locations serving 50-plus countries. www.dentons.com.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.