Subject Access Request Procedure

[brubaker]

Hi people

 

 

I recently sent in a SAR to my previous Employer to see what information they held on me relating to an incident that happened at work.

 

 

The request was sent to their Privacy and Data Protection Team, but looking at the information they sent me there appeared to be missing information (emails).

 

 

Should the team deal with these requests covertly and not inform any parties that appear in the data held about me? Or is it procedure to inform any parties involved? They advised me that they need to inform parties to locate the information, but I suspect this information can be accessed through the Exchange Servers (email).

 

 

Thanks

[silverfox1961]

Hi

If they have stored the emails then they should make them available to you however, if there is another persons name on the emails, they quite rightly should redact that info as that is not your personal data.

 

I would send them a failure to comply letter spelling out what they have (in your opinion) missed and see what they come back with.

[brubaker]

Thanks for the information, I will do that.

 

 

Thanks