How To Redact Subject Access Request SAR Redaction Explained

Need help redacting a Data Subject Access Request (DSAR / SAR)? We are the global market leaders for just this service. We can help by offering a fully outsourced Redaction Service. We offer our redact service in all English speaking parts of the World. We take the pain out of the process for you. We can offer a one off service or put a process in place to tackle ongoing SAR response. It's a simple process and we will deliver well before your deadline. You upload your data to our safe and secure portal (or we utilise your SFTP option). We redact the personal details of third parties and other private content and you download the finished product. Our service combines Ai techniques with three full human read through's. Put simply this is not something software alone can process - despite what some products suggest. Our experienced human input is still vital. Why not get an SAR redaction quote today.

An example of our expertise is the innovative methods that we have developed to tackle the problem of endless email trails and duplication. This is a big cost saver that we aim to pass on to you! We combine experienced human input, AI and machine learning to make a real difference.

Subject Access Requests (SAR's) or Data Subject Access Requests (DSAR) – when a subject asks to see any personal data held on them – need to be handled with great care. You need to satisfy the SAR but at the same time you have a duty protect via redaction the private data related to other individuals. We can redact the data for you and that can be a big help. Our aim is to emphasise the positives, and embrace the spirit of the law turning your Organisation into Champions of personal data!

We offer a FREE of charge. NO obligation data survey giving a fixed price and delivery date for every redaction project. Get in touch today. You have nothing to lose...

Failing to respond or provide all the requested data can be a risky business. Firstly it could lead to a deterioration between Organisation and employee. Secondly it could result in a large fine, financial penalty and or an enforcement notice. Finally it could trigger a wider investigation into a Companies data protection activates and policies by the ICO. Employers cannot afford to take subject access requests lightly.

Chances are you have had a Subject Access Request SAR and hopefully the information here will help. If not it's really worth getting yourself prepared. Put a team and policies in place to deal with them. Keep a list of all the systems and locations where personal data is stored. Remember it is not just emails and attachments, it can be text messages, spreadsheets, internal messaging systems, management information etc. Having contacts and processes established in advance will help you respond to a SAR more efficiently.

Double check that the SAR has been made correctly. Your allocated time will not start running until then. If you are looking for extra time this is an area that you may be able to exploit. We advise our clients that are likely to receive multiple requests over time to streamline the process of how SAR's are received and accepted. Don't forget to acknowledge receipt formerly.
Again if you are looking for time consider asking for more information. You cannot demand the individual narrows the scope of their Subject Access Request but you can ask about some areas, for example time frame or search terms. You do not have to comply with the SAR until you have received the information that you reasonably require in order to respond and locate the information sought. For example, can you identify the owners of the data and the search criteria?
It is advisable to start dealing with a request as soon as possible, as in our experience it often takes longer than you think. Build in time for a review by you and perhaps your legal advisers, especially if there is third-party personal data which will need to be redacted. As mentioned we can help with this why not get a quote.
Do not forget hard copy data. Again we can help with this. As a leading scanning bureau we can scan all sizes and shapes of document and provide a redacted copy. We also have a capacity to scan small or bulk volumes of documents.
In these changing times (Brexit) it is wise to consider any cross border issues. The DPA 2018 sets out the framework for data protection law in the UK. It sits alongside the UK GDPR, and tailors how the GDPR applies in the UK. GDPR is implemented differently in each member state. There can be even greater differences between other jurisdictions, such as the US (We operate our redaction service throughout the US). If information is held in another country, you will need to consider whether it is in breach of local laws to treat data stored in that location in accordance with UK principles.
Consider whether an exemption applies. Again this is a good reason to use a professional service such as ours. Personal data can be exempt from disclosure. For example, if the information is legally privileged. See blow for more.
Where possible look to provide the documents electronically rather than in hard copy form, its cheaper easier to distribute and has a lower carbon footprint. Again via our redact service we can make help with this area.

A Subject Access Request SAR had been made of a SME under DPA:2018 / UK GDPR regulations. They had to provide copies of all the data related to a disgruntled employee but did not want to divulge personal details that related to other team members or that were strategically private to the Business. We worked with the Company to agree the specification. We redacted emails, attachments, an internal messaging system, text messages, Word and Excel spreadsheets. We agreed a completion date well before the SAR deadline and hit this to the agreed budget.

“Marvellous customer service. Regular, reassuring updates during the project. Great job efficiently done within deadline.” Operations Director.

More On Subject Access Requests…

A subject access request (SAR) is simply a written request made by or on behalf of an individual for the information which he or she is entitled to ask for under the Data Protection Act 2018 (DPA:2018) / UK GDPR throughout the UK and EU GDPR in the EU. Generally this is any information that an Organisation holds where the ‘Subject’ is the focus.

For small, uncomplicated, infrequent projects in-house redaction may well be an option. However for larger Subject Access Request projects it usually pays to benefit from. Why not get a quote and compare the two options:

Our experience. +20 years of lessons learnt really does allow us to drive the cost down and pass this onto to you.
Time is also a consideration. Often Companies approach us because a deadline is impossible to meet with the resources that they have available.
Quality is also a vital factor. Our unique quality system has been developed over 20 years and by definition is far superior to an inexperienced in-house option.
Technology is also very important. Our redacted end product is guaranteed irreversible. Some products appear so and this is not the case.

You don't need to supply these to the requester. They can be redacted if contained within other information that you do need to make available.

Health records: are not required to be disclosed where this would cause serious harm to the physical or mental health of the employee or another person. A difficult call this. Perhaps best to get professional advice f you feel this may apply to you.
Management forecasting or planning: disclosure is not required where it would prejudice the conduct of the business. For example, an employer does not have to disclose details on potential staff redundancies in the pipeline if no announcement has yet been made public.
Confidential references: these sometimes need to be given about an individual, for example an employee reference. Only references that are received from a third party need to be given. Any you have supplied are exempt.
Information relating to a third party who can be identified from the information: does not need to be disclosed unless that third party consents or it is reasonable to comply without consent. However, whilst third party information should be redacted (this is our speciality we can help) where appropriate, the employee's personal data should be disclosed if it does not fall within any of the exemptions.
Legal professional privilege: any data regarding the giving or receiving of legal advice, by solicitors or barristers, does not need to be disclosed. Unless where in-house counsel is copied in on emails as a matter of course, the data is not exempt, unless they are being asked specifically for legal advice.

The Data Protection Act 2018 sets out the framework for data protection law in the UK. It updates and replaces the Data Protection Act 1998, and came into effect on 25 May 2018. It sits alongside the GDPR, and tailors how the GDPR applies in the UK. This delivered some changes to the subject access regime. Firstly, data must be provided free of charge, unless the request is “manifestly unfounded or excessive”, in which case the data controller may charge a reasonable fee or refuse to act on the request. Secondly the time limit for compliance changed from 40 days to “without undue delay and in any event within one calendar month”. However, the one month period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The employee should be informed of any extension within one month of the request, as well as the reasons for the delay. If your need is more current we can help. We can redact your data for you. Get in touch today.

We await to see how Brexit will change things here in the UK. More broadly we are all interested to see how the ICO look to enforce penalties and the pinch point for these. Our hope at CCS is that Organisations accept the good intention behind the Regulations and look to become Champions of information. Providing individuals with all they are entitled to whilst protecting the privacy of others.

Lets Chat 01663 746604

Services

Useful Links

Newsletter