The right of access, commonly referred to as subject access, gives individuals the right to obtain a copy of their personal data and helps individuals understand how and why you are using their data, and check you are doing it lawfully.
Individuals have the right to obtain the following from you: confirmation that you are processing their personal data; a copy of their personal data; and other supplementary information – like the information that you may provide in a privacy notice. An individual is only entitled to their own personal data unless they are acting on behalf of someone.
In addition, if requested, you also have to provide individuals with the following information: the purposes of your processing; categories of personal data concerned; any recipients you disclose the personal data to; your retention period for storing the personal data; information about the source of the data, where it was not obtained directly from the individual; the existence of automated decision-making (including profiling); and the safeguards you provide if you transfer personal data to a third country or international organisation.
The individual has the right to lodge a complaint with the ICO or another supervisory authority and also has the right to request destruction of their personal data.
An individual can make a subject access request to you verbally or in writing. It can also be made to any part of your organisation (including by social media) and does not have to be to a specific person or contact point.
It is good practice to have a policy for recording details of the requests you receive, particularly those made by telephone or in person. Make it clear to the person requesting access that you have understood their request and keep a record of any requests and if an individual makes a request electronically, you should provide the information in an electronic format, unless the individual requests otherwise.
As a matter of course the GDPR requires that the information you provide to an individual is in a concise, transparent, intelligible and easily accessible form, using clear and plain language. (This is particularly important where the information is addressed to a child or someone with certain disabilities).
If you want to know more, or wish to see the webinars via the DLM Group portal, contact us now.