SAR response format, context and portability procedure

Scope

Use this procedure when a subject access request (SAR) is received with a data-portability request, when secure remote access is considered, when the requester asks for an alternative or verbal response, or when the information to be supplied is coded or otherwise difficult to understand.

1. Separate the access and portability requests

When a SAR and a data-portability request are made at the same time, consider which information falls within the scope of each request.

For the access request, consider all personal information held about the requester, including observed or inferred information, unless an exemption applies. For data portability, consider only personal information provided by the requester where it is processed by automated means on the basis of consent or contract.

Apply the format appropriate to the right concerned. Access may require information to be provided in a commonly used electronic format. Data portability requires personal information provided by the requester to be supplied in a structured, commonly used and machine-readable format, and includes the option of transferring it directly to another controller.

2. Select the response or transfer method

Consider the requester’s circumstances, the capability of the system and the information involved when selecting the response or transfer method.

Secure remote access may be used where a suitable secure system is available. Before using this approach, consider whether the requester can download a copy of the requested personal information in an accessible, commonly used electronic format and whether the requester objects to using remote access.

If those conditions are met, providing remote access may satisfy the requirement to provide a copy. Remote access is not appropriate for every organisation or every request, so consider an alternative approach where it is unsuitable.

Where an accessible format or another response approach is requested, consider a reasonable approach having regard to the requester’s circumstances and the information to be supplied.

3. Respond verbally where requested

A SAR may be answered verbally when the requester asks for this and their identity has been confirmed by other means. This approach is most likely to be suitable where a small amount of information has been requested.

Before providing the verbal response, ensure that the request date and identity-verification information are recorded. After the response, record the response date, who provided the information and the information provided.

4. Explain coded or difficult-to-understand information

Where personal information supplied in response to a SAR is not in a form the requester can easily understand, provide additional information to put it into context and aid understanding.

If information is coded and the organisation’s key or index is needed to understand it, explain the meaning of the codes using the relevant key or index.

This does not require significant effort, translation of the information or deciphering unintelligible written notes. Information does not have to be made legible where it is poorly written.

5. Record the approach taken

The [data protection lead role] should ensure that the chosen approach is recorded, including the separation of access and portability information, the format or transfer method selected, and any consideration of accessibility, comprehension or the requester’s circumstances.