Subject access requests: shorter timeframe under General Data Protection Regulation

26 April 2016

Employers may need to rethink the way they handle subject access requests (SARs) from staff to ensure they comply with new EU data protection laws that have been finalised.

The General Data Protection Regulation (GDPR) will require employers to respond to SARs in a shorter timeframe than that which applies under existing UK data protection laws when it comes into force in the middle of 2018.

The new timeframe will pose a challenge for employers that do not have a defined process for handling SARs. A failure to meet the deadline or provide employees with access to all the data they request could expose employers to a significant fine under the new Regulation.

If this change could affect you or your business, you can read the full details on With thanks to Pinsent Masons for providing the details.