Subject Access Request: Strategy, Tactics and Risks

More and more organisations are on the receiving end of extensive subject access requests from clients or customers, employees or even members of the public.

Dealing with requests can be a headache. In addition to coping with the sheer volume of documents such requests can produce, overstretched IT or HR or compliance personnel need to work with concepts which have yet to be defined (for example what is “manifestly excessive”?), apply complex doctrines (such as the law relating to privilege) and deal with complex issues (such as how to treat the data of third parties). Some responses need a bespoke, painstaking approach, others permit a more pragmatic commoditised reply, but it can be tricky to know where the balance lies.

Bearing in mind subject access requests and the regular DPA complaints that follow them are a “shop window” to an organisation’s general data protection compliance, it is important that anyone involved in responding to subject access requests is aware of the issues.

In our breakfast workshop, we look at some FAQs on subject access requests as well as share experiences in dealing with them, and related regulatory complaints.

If you have any questions or a colleague based in Dublin would like to attend, please contact our events team.