Subject Access Request Template Tracker

Responding to a subject access request within statutory timescales is a real challenge. Finding, reviewing and collating all the information you hold about a person in 30 days or less involves a lot of steps, and can involve a lot of people. It can be easy to lose track, miss a step and generally miss deadlines.

• Find more free GDPR resources here.

What Are The Main Challenges with a Subject Access Request?

In our experience people sometimes have a lot of data about people. A particular example is employees. Everything from HR files to the volume of internal emails containing their information (name, email address) is in scope. Finding it and collating it is one big challenge.

Then comes reviewing the data and where necessary redacting it. Some things are exempt from disclosure, and in most circumstance you need to remove the data of other people from anything you propose to disclose.

Alongside the data the GDPR requires you to provide supporting information for each data item – whether you disclose it or not. This includes the lawful basis for data processing, and whether or not the data have been shared with third parties. This can be difficult to get right, especially for older data.

Why Do Deadlines Matter?

Failing to meet statutory deadlines could put you at risk of enforcement action. This is more likely if you are serially non-compliant and tend to go well over deadlines.

Two bigger risks are:

• The operational challenges of managing lots of requests at once if you develop a backlog
• The reputational risk of being seen as failing to manage personal data properly.

The Template

The template is designed to help keep you on track to meet the standard 30 day response deadline. It sets out the key steps involved in responding to a subject access request (including keeping the requestor updated), but of course you should respond earlier if you can.

How to Use The Template

The template has four main parts.

1. The top row where you should record (a) the reference number of the request, (b) the name of the person with overall responsibility for the request – for example your Data Protection Officer, and (c) the data the request was received. This is most important, because the timeline is calculated from this date.
2. The RACI matrix, where key responsibilities, accountabilities, and who is consulted and or informed at each step are set out. You can change these to suit your organisation’s structure and use it to ensure the right people are involved at each step.
3. The actual date each step was completed (column I). This will help identify where you processes might need to be improved if, for example, one step is a persistent cause of missing deadlines.
4. The comments column (column J). This is useful for noting key communications and what happened as each step was completed.

You should adapt the steps in the template to meet your needs – for example, the timing of updates to the requestor, and you may need to adjust calculated dates to reflect non-working days.

Create a new version of the template for each request you receive, and once a request is done keep the template to help provide an audit trail of how you complied.

Download the Subject Access Request Template Here