In the second of our five part blog series on Data Subject
Access Requests (DSARs), we examine the notion of
"complexity" and how that might affect the way you
respond as an employer to a DSAR.
What is "complex"?
Under the General Data Protection Regulation (GDPR), data
controllers must respond to DSARs "without undue delay and
in any event within one month of the receipt of the request.
The period may be extended by two further months where necessary,
taking into account the complexity and number
of requests."
However, there is little to no guidance on what would be
considered "complex" for these purposes.
In our view, given the particular nature of employee DSARs,
where it may be necessary for an employer to process numerous
different sets of information across the organisation, many such
requests could cross the threshold into complexity.
