Subject Access Request (SAR) Checklist form

Subject Access Request (SAR) Checklist

1. Receipt of SAR:

SAR received from individual (in writing or verbally).

Date of receipt recorded.

2. Verify Identity:

Verify the identity of the individual making the SAR.

Request additional information or documentation if necessary.

3. Acknowledge Receipt:

Send acknowledgment letter to the individual confirming receipt of SAR.

Provide estimated timeline for response.

4. Assess Validity of SAR:

Review the SAR to ensure it is valid and includes necessary information.

Determine whether any exemptions or limitations apply.

5. Conduct Data Search:

Conduct thorough search for the requested personal data across all relevant systems, databases, and paper records.

Document the search process, including sources searched and any challenges encountered.

6. Review and Redact Data:

Review personal data found to ensure relevance to the SAR.

Apply appropriate redactions to remove any third-party personal data or confidential information.

7. Prepare Response:

Prepare response letter to the individual providing access to the requested personal data.

Include details of any exemptions applied, legal basis for processing, and instructions for accessing the data.

8. Provide Response:

Provide response to the individual within one month of receipt of SAR, unless an extension is necessary.

Send response electronically or by post, depending on individual's preference.

9. Record-Keeping:

Maintain accurate records of SARs received, actions taken, and responses provided.

Store records securely and in accordance with data protection laws.

10. Review and Follow-Up:

Review SAR process periodically to identify areas for improvement.

Address any feedback or complaints received from individuals regarding SAR handling.

Version: [1.0]

Issue date: [date]