15 January 2020: be part of ICAEW's response to the ICO's draft guidance on dealing with data subject access requests.

The UK Information Commissioner (ICO) has issued a consultation on its draft guidance on dealing with data subject access requests under the GDPR. This is because the GDPR has strengthened the right of data subjects to request a copy of their personal data processed by a data controller, and to request further information about how a data controller processes their personal data and shares it with third parties. Coupled with data subjects’ increased awareness of this right and the consequent increase in requests being made, such guidance is timely.

The draft guidance discusses the right of access in detail for those who need a deeper understanding of when and how they should respond to a data subject access request. In particular, the draft guidance deals with questions such as:

• how to recognise a subject access request;
• what should be considered when responding to a request;
• how to find and retrieve the relevant information;
• how to supply information to the requester;
• when you can refuse to comply with a request;
• what to do if the request involves information about other individuals;
• exemptions; and
• special cases.

"We are very keen that the ICO should understand the problems encountered by and the concerns of ICAEW members and reflect this in their new guidance," says Dr Jane Berney, ICAEW Technical Manager for business law.

Members can either complete the online survey themselves by 12 February 2020, or submit their comments to jane.berney@icaew.com by 1 February 2020, for inclusion in an ICAEW response on behalf of members.

• To help with any questions you may have, ICAEW has built a GDPR hub which is kept up-to-date by Jane Berney.