Under the GDPR rules, an individual can make a formal request, asking a company to search their IT systems and produce the information and documentation the company has stored on the individual. 

This type of request is commonly known as a Subject Access Request (SAR).

There are many reasons why a company will receive a SAR. Common SAR’s we help our clients handle:

• From former disgruntle employees.
• Individuals who work for competitor organisations.
• Individual who was unsuccessful when applying for a promotion or external applicants applying for senior positions.
• Individuals who work at a supply or a customer who has had their contracts/agreements changed. 

What rules does GDPR provide individuals when making a SAR:

1. The right of access. Individuals can submit SAR, which requires the company to provide a copy of any personal data they hold about the individual.
2. The right to erasure. Individuals can request that the company erase their data in certain circumstances, if the data is no longer essential if the data was unlawfully processed. If the individual withdraws consent.
3. The right to erasure is also known as ‘the right to be forgotten’.

Typically, throughout Europe, a company has around 30 days to acknowledge a SAR and produce the information/documents.

Failing to respond to a SAR can be very costly, in the UK the Information Commissioner’s Office (see here ) can impose a higher maximum or a standard maximum fine. Under UK law a fine could be up to 20 million Euro or 4% of the total annual worldwide turnover.

Each European country sets its penalties for non-compliance and companies are not only becoming financially penalised, but a company’s public reputation can also be damaged.

Therefore, a company needs to have a robust process in place to handle a SAR. 

LTI’s team of consultants and technology offering provides a fast, auditable and inexpensive way to handle 1 or 100 SARs. 

Our services include:

• Identify where and how documents are stored.
• We gathered and collect the documents in a defensible way.
• Using our secure and specialised document search and document review platform.
• Apply filters to suit the SAR requirements.
• Allow you to review and make blackouts/redactions on SAR responsive documents.
• Provide the Individual/SAR to the documents in a controlled and secure online platform.
• Provide a report on the documents the Individual/SAR would like erasure.
• Delete the documents from your IT environment.
• Provide an audit report of the full process.

If you have a project or a scenario you would like to discuss, please do not hesitate to contact us: info@legaltechinnovations.com