Request
1. Please advise how many Data Subject Access Requests (hereafter referred to as SARs) you received and responded to in 2021, 2022 and 2023 relating to employees (past or present) and other requests (e.g. customers, general public, service users etc).
The next few questions relate to the SARs process which includes collating (pulling the data together from across your organisation/department), redacting the data, pulling the information/ data together into a response and checking the information before issuing it to the requestor.
2. When responding to SARS do you manage the process in-house, or do you outsource the whole or part of the process? And if conducted in house please specify the name of the team/function that is responsible for this part of the process (eg Data Privacy, HR, etc).
3. Approximately how many working hours does it take to pull together a typical SARs response, this includes the time taken to collate and redact the information, and putting the information together for issuing?
4. What is the estimated percentage of handwritten documentation within a typical SAR response?
Outcome
Information provided.
Response
1. Please advise how many Data Subject Access Requests (hereafter referred to as SARs) you received and responded to in 2021, 2022 and 2023 relating to employees (past or present) and other requests (e.g. customers, general public, service users etc).
Our records show that we have received the following number of SARs for personal data in closed archival records from 2021-2023:
- 2021: 86
- 2022: 87
- 2023: 307
These SARs have been made by the general public.
We have also received the following number of SARs for personal data in corporate (business) records:
- 2021: Employees: 0, Other: 3
- 2022: Employees: 0, Other: 1
- 2023: Employees: 1, Other: 4
2. When responding to SARS do you manage the process in-house, or do you outsource the whole or part of the process? And if conducted in house please specify the name of the team/function that is responsible for this part of the process (eg Data Privacy, HR, etc).
SARs are processed in-house. The Data Protection Officer processes SARs for information in corporate records, and FOI officers process SARs for information in closed archival records.
3. Approximately how many working hours does it take to pull together a typical SARs response, this includes the time taken to collate and redact the information, and putting the information together for issuing?
We do not hold recorded information that would allow us to answer this question. Furthermore, we would advise that every request is different, and we have no definition of what constitutes a ‘typical’ SAR.
4. What is the estimated percentage of handwritten documentation within a typical SAR response?
We do not hold recorded information on estimates, and neither are we able to provide one if this question was to be framed as a general enquiry.