Four things you might not know about Data Subject Access Requests
Four things you might not know about Data Subject Access Requests
Last week, Kilgannon & Partners LLP had it’s first HR Forum, an opportunity for Senior HR Leaders from a variety of different organisations to get together and discuss a particular topic. This week we talked about Data Subject Access Requests (“DSARs”) which have been on the rise since the GDPR was introduced last year.
Emily Kidd, our GDPR expert, gave some practical tips about dealing with such requests, how to respond and what you need to disclose. Here are four things that you might not be aware of:
1. A DSAR can be made orally.
In practice, we imagine that this would be difficult to prove as with any other verbal request. However, data controllers should be aware that if a person telephones you or calls you into a meeting and requests their data, you should treat this as you would ordinarily treat a written DSAR.
2. IP addresses and browsing data is covered.
Personal data does not necessarily mean that the data subject is personally named. If you monitor your staff’s browsing history, this would be classed as personal data if it can be traced back to the individual (as opposed to a shared computer). In particular, you will need to be very careful about this type of monitoring where an individual works from home and uses their own device.
3. Retention periods
One of the things that you need to tell data subjects when responding to a DSAR is how long you intend to keep their data. You need to make sure that you have a suitable retention policy in place but, most importantly, that your organisation is adhering to that retention policy. It’s no good having a lovely policy tucked away in a drawer than nobody is aware of.
4. References
There is no longer any obligation for a reference given in confidence to be disclosed in response to a DSAR whether you are the giver or recipient of the reference.
If you have any questions about DSARs, GDPR or any employment law issues, please do not hesitate to get in touch with Emily on ek@kilgannonlaw.co.uk
or via www.kilgannonlaw.co.uk.
Did the use of NHS changing room by transgender woman give rise to claims for harassment and/or indirect discrimination?
The appeal judgment criticised the original tribunal’s handling of both disability and justification issues. The judgment indicates that employers making dismissals based on assessment of readiness for promotion, without the employee having carried out the work for the role above, will struggle to show that decision is
Ms Sanju Pal succeeds in appeal against Accenture at the Employment Appeal Tribunal – Tribunal’s reasoning on disability discrimination due to endometriosis was “wholly inadequate” and the decision could not stand
A tribunal ruled non-binary identity does not amount to gender reassignment. Learn the legal reasoning and workplace implications with Kilgannon Law.
A tribunal has held that the dismissal of a cleaner working two jobs and 17-hour days was fair. Learn why the decision was upheld, the key factors considered, and what this means for employers managing fatigue and safety risks.
Understand how employee share options work, the different types available, and their tax implications. Learn how share schemes can reward staff, attract talent, and support business growth.
From 1 December 2025, ACAS early conciliation will double to 12 weeks. Discover what this change means, how it affects tribunal time limits and backlogs, and why more time may not always benefit employees or employers.
Analysis of Sanju Pal v Accenture UK Ltd: appeal on endometriosis, consulting model, and Category A classification in the EAT, 9–10 Dec 2025.
A full time employee that is over 21 will soon be earning nearly £24,000 per annum which could mean that more employees are close to the minimum wage. Having an employee working close to the minimum wage poses risks to businesses. For example, if an employee works any overtime, they may then fall below the minimum wage.
Kilgannon & Partners outlines key steps to comply with the new UK duty to prevent workplace sexual harassment. Services include risk assessments, policy updates, staff training, and confidential reporting. Contact us for support.
