New ICO guidance published on the time limits for responding to data subject access requests (DSARs).
The ICO’s revised guidance confirms that where a data controller asks the individual making the subject access request for additional information in order to enable them to deal with the request effectively the one-month time period for compliance will no longer be paused until after the controller receives the requested information. The amended guidance also confirms that the extended timescale for responding to complex or multiple DSARs will similarly also no longer be paused.
These changes mean that the new timescale for responding to subject access requests will run from the date that the DSAR is received or, if later, the date on which proof of an individual’s identification has been received. This constitutes an important change from the previous position which stated that the time period for compliance would be paused until the controller was in receipt of any additional information that had been sought from the individual.
The ICO’s revised Right of Access guidance confirms that where additional information is requested from the data subject by the controller, to enable it to properly respond to a subject access request, then:
“…..this does not affect the timescale for responding – you must still respond to their request within one month. You may be able to extend the time limit by two months if the request is complex or the individual has made a number of requests”.
Controllers will likely be concerned that any delay on the data subject’s part in providing any additional information that has reasonably been requested will have an adverse impact upon their ability to provide all of the necessary data within the required timescale. For this reason, the use of subject access request forms may become more common as controllers take steps to try and limit the impact of the ICO’s changes by encouraging data subjects to provide relevant information at the same time that the subject access request is submitted.
Please contact us if you’d like more information about the issues raised in this article and/or or to find out more about the various legal services that we provide.