ICO publishes new guidance on data subject access requests

The ICO has published its new guidance on data subject access requests (“DSARs”). The new guidance provides some useful clarifications and practical points for companies, in particular:

• When companies can ‘stop the clock’ on the standard 30-response deadline.
• Clarification on the definition of “manifestly excessive” requests.
• The efforts that companies have to make to find the requested information.
• What to do about information that contains data from third parties.

We have reviewed the ICO guidance in further detail in our article.

Companies should review their internal DSAR processes or guidance to assess if any updates or clarifications should be included to reflect the new ICO guidance.