Data subjects have several rights under the UK GDPR, including the right to access the personal data your organisation holds about them. Your business may face a problematic ex-employee or a demanding customer who continuously sends subject access requests (SARs) and wonder what to do. SARs can be time-consuming and complex, and you may question whether your business must always comply with such requests. Under the UK GDPR, there are circumstances where your business can refuse to respond to SARs. This article will explore some common grounds companies can consider relying upon to say no to a subject access request.<\/p>\n\n\n\n
A SAR allows individuals to request a copy of their personal data held by your business. It is a core right under the UK GDPR<\/a>, which aims to afford individuals transparency and control over the use of their personal information. <\/p>\n\n\n\n Individuals are entitled to know whether your business processes their data, obtain a copy of the personal data, and receive additional information such as why their data is being processed, who it is shared with, and how long it will be stored. <\/p>\n\n\n\n Your business can refuse to comply with a subject access request<\/a> under specific conditions.<\/p>\n\n\n\n Common grounds to deny the request include the following:<\/p>\n\n\n\n The UK GDPR contains various legal exemptions that you could use to avoid complying with a SAR request.Examples of these exemptions include legal professional privilege, preventing crime, and safeguarding third-party data. However, these exemptions must be carefully considered on a case-by-case basis, and you should ensure that they are not applied broadly or as blanket policies.<\/p>\n\n\n\n Suppose the individual has no genuine intent to exercise their right to access their data but instead attempts to do so to harass or disrupt your business. In that case, you may be able to justify refusing the request. <\/p>\n\n\n\n For example, if an individual makes repeated SARs and offers to withdraw them in exchange for compensation or a benefit, the request would be considered manifestly unfounded.<\/p>\n\n\n\n You may refuse a request if it imposes an unreasonable burden on your business due to the amount of data requested or the frequency of requests, making compliance impractical. However, you should not consider the request as excessive just based on the volume of data requested. You must assess whether the request is unreasonable when balanced against the individual’s need for the information.<\/p>\n\n\n\n Many businesses may face a situation where a disgruntled employee, perhaps gearing up for a claim or having raised a grievance, submits a SAR demanding access to all documents, emails, and correspondence that mention them. This tactic is a way to gather evidence for potential claims, and such requests can significantly strain company resources. However, suppose your business can demonstrate that the request is being used maliciously, intending to disrupt, or imposes an unreasonable burden due to the volume or nature of the data requested. In that case, they may be able to justify refusing the SAR.<\/p>\n\n\n\n However, your business must assess each SAR individually based on its specific context, as the UK data protection regulator’s guidance discourages blanket refusals. You should also keep records documenting your justifications for refusal to demonstrate compliance with the UK GDPR.<\/p>\n\n\n\n A request is manifestly unfounded when it is clear that the individual is not genuinely interested in their personal data but has malicious intent. This could include submitting the request to harass or disrupt your business or offering to drop the request in exchange for a benefit such as financial compensation. <\/p>\n\n\n\n For example, if a customer submits a SAR but later offers to cancel the request if your business provides them with a discount or voucher, this will likely come under this exemption, and you can lawfully refuse to comply.<\/p>\n<\/div>\n\n\n\n A subject access request<\/a> becomes manifestly excessive if fulfilling it places a disproportionate burden on your business in terms of resources or cost. <\/p>\n\n\n\n To assess whether a request is excessive, you should consider factors such as the nature of the relevant data. You should also consider whether the request repeats previous SARs, and the effort required to respond compared to the benefit for the individual. For example, numerous requests within a short period, with no significant change in data, may be excessive.<\/p>\n\n\n\n\n\n Continue reading this article below the form\n <\/i>\n<\/a>\nCan You Refuse to Comply with a Subject Access Request?<\/h2>\n\n\n\n
An Exemption Applies<\/h3>\n\n\n\n
The Request is Manifestly Unfounded<\/h3>\n\n\n\n
The Request is Manifestly Excessive<\/h3>\n\n\n\n
What Does Manifestly Unfounded Mean?<\/h3>\n\n\n\n
What Does Manifestly Excessive Mean?<\/h3>\n\n\n\n