Rights briefing
When a subject access request lands
A subject access request becomes difficult when identification, search, review and disclosure decisions have not been designed before the deadline starts.
5 minute readA subject access request can look simple at first and expand quickly across email, HR systems, messaging platforms, case files and supplier-held information. The deadline is only one part of the problem. Scope, identity, third-party information, exemptions and secure disclosure all require decisions that should be consistent and defensible.
Where pressure builds
- The request is not recognised promptly or reaches the wrong team.
- Searches produce large volumes of duplicate, irrelevant or third-party information.
- Operational teams make inconsistent decisions about scope or exemptions.
- The final disclosure is late, incomplete or sent without appropriate security.
What a defensible process needs
The aim is a proportionate response with a clear audit trail, not the indiscriminate release of every document containing a name.
A named owner, reliable deadline, documented scope and a route for escalating difficult judgement calls.
A method that can identify relevant personal data without losing context or overlooking key systems.
Consistent decisions on third-party data, exemptions, explanation and secure delivery.
Where organisations get caught out
- Confusing documents with personal data and reviewing far more than necessary.
- Waiting for the requester to use formal wording before starting the process.
- Overlooking information held by processors or in informal communication tools.
- Relying on undocumented judgement when withholding or redacting information.
How LAUDIS helps
Turn the issue into a controlled piece of work
We can assess the position, help make and document the difficult decisions, remediate weaknesses and leave your team with a process that works in practice.
See LAUDIS rights request support →