GDPR: Subject Access Requests – What's New?

Do not be complacent, GDPR is making some subtle but important changes to the well-known system for subject access requests under the Data Protection Act 1998 ......

Shorter timescale for response

Employers will have to respond "without delay" to requests and at the latest within one month of receiving the request. There are limited grounds for a 2 month extension but the employer must (a) notify the employee that more time will be required within the first month of the request, and (b) givethe reason for the extension.  Under the Data Protection Act 1998 employers had 40 days to respond.

No fee

Gone is the £10 fee regime under the Data Protection Act 1998. Under GDPR employers must provide a copy of the requested information FREE of charge unless (a) the request is 'manifestly unfounded or excessive' (we await further guidance on what this actually means...in the meantime we would suggest you don't rely on it), or (b) the information requested has already