Subject Access Requests
The question
To ask the Secretary of State for Science, Innovation and Technology, what steps her Department is taking to ensure the ICO's statutory duty to enforce SAR disclosures are met within a one month timeframe.
Answered by Ian Murray
The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA) provide individuals with the right to access their personal data, subject to relevant exemptions. A subject access request must be responded to within one month of receiving the request. The response time may be extended by a further two months if the request is complex, or if the individual has submitted a number of requests, provided the organisation informs the requestor within the one-month period and provides reasons for the delay.
The Information Commissioner’s Office (ICO) is responsible for monitoring and enforcing the data protection legislation independently of government, and is accountable to Parliament.
Verbatim has judged this answer against the question that was actually asked — answered, partly answered, or evaded. Sign in to see the verdict →