Subject Access Requests and Compensation Claims:
What Parish and Town Councils Should Know
Recently, a number of organisations across the UK have reported receiving emails from individuals claiming that their GDPR rights have been breached following a verbal Subject Access Request (SAR), sometimes accompanied by a request to discuss compensation or an out of court settlement.
We wanted to provide some guidance to parish and town councils in case you receive a similar message.
What is a Subject Access Request?
Under the UK GDPR, individuals have the right to ask an organisation whether it holds any personal data about them and to request a copy of that data.
This is known as a Subject Access Request (SAR).
A SAR does not need to use specific wording and can be made:
- By email
- In writing
- Verbally, for example over the phone
Once a valid request is received, organisations normally have one month to respond.
Identity verification is allowed
Before releasing any personal data, organisations are allowed to verify the identity of the person making the request.
This is an important safeguard to ensure personal information is not accidentally disclosed to the wrong person.
If the organisation needs to confirm identity, the response time can be paused until the requester provides suitable identification.
Requests must be clear enough to process
Sometimes requests are very vague, for example asking whether an organisation holds “any information about me”.
In these cases, organisations can ask the individual to clarify the request so that the correct data can be located.
Compensation claims and settlement requests
Occasionally individuals may claim that a GDPR breach has occurred and ask to discuss compensation before initiating legal action.
It is important to remember:
- A breach is not automatically established simply because someone claims it has occurred.
- Organisations are entitled to verify identity and clarify requests before processing them.
- The normal process would usually involve a complaint to the Information Commissioner’s Office (ICO) before court proceedings.
For this reason, organisations should avoid engaging in discussions about compensation without first following the proper SAR process.
What should councils do if they receive a request?
If you receive a request relating to personal data:
- Acknowledge the request.
- Ask for identity verification if necessary.
- Clarify the scope of the request if it is unclear.
- Respond within the required timeframe once the request is valid.
