Recognising when a DSAR has been submitted
One thing that makes DSARs so difficult to handle is that there is no official process or protocol for submitting one.
This can make them difficult to recognise – particularly if it comes through to a junior team member in a non-legal department, such as a social media or admin executive. Regardless though, once a DSAR has been made, the recipient organisation has one calendar month to fulfil the request – so any additional time it takes to recognise a DSAR, and figure out who it should be escalated to, is likely to be time you can’t afford. Missing this deadline can lead to serious sanctions from the Information Commissioner’s Office (or ICO), not to mention lasting damage to your credibility and reputation.
Because of this, it’s vital that staff at every level of your organisation, from operations to HR to legal, have a foundational knowledge of what constitutes a Data Subject Access Request. So whether it comes via email, or over Twitter, and no matter how formally or casually it’s worded, your team can recognise it, escalate it, and ensure it is treated with the appropriate levels of efficiency and severity.
