Data Subject Access Requests: Common Employer Queries

How should employers deal with data subject access requests and how will the process change for employers when the General Data Protection Regulation (GDPR) comes into force in May 2018? Clare Gilroy-Scott, a partner at Goodman Derrick LLP, answers some common questions about data subject access requests.

Data subject access requests are relatively easy to make, but can be problematic and time-consuming for employers.

Although their main purpose is to enable the individual to check that his or her data is processed lawfully in accordance with the Data Protection Act, many employees use requests as fishing exercises prior to legal action.

The Information Commissioner (ICO) has made it clear in its June 2017 code of practice that it is irrelevant if there is a "collateral purpose" to a request.