Subject Access Request Record

This record is one step in a larger programme. Using it for work that belongs to a neighbouring template produces records that are hard to report on later.

ISO 27701 frames access as an obligation owed to the individual directly, distinct from general security controls, and GDPR and equivalent regimes attach a fixed, short deadline and narrow exemptions to that obligation.

The right of access is close to universal. What varies is the deadline length, whether extension is permitted, and how narrowly exemptions such as third-party data are drawn.

The template walks the request through search, preparation and response. What decides whether the response satisfies it is judgement none of those sections enforce by themselves.

The findings below concern whether the search was complete and the response answers the request, not whether the form was filled in on time.

A former employee raised a subject access request after a disciplinary process, asking for everything held about them. HR searched the personnel file, case notes and email, redacted two colleagues' names, and responded within the one-month deadline. Response Complete and Rights Explained were both recorded Yes.

The complaint that followed was not about the redactions. It was about CCTV footage the requester knew existed, mentioned in a meeting, which nobody had searched for because it lived with facilities management, not HR. The response was thorough within systems HR controls, and incomplete against the request as understood. The fix was making Monitoring And Camera Data Considered its own required field, so a request cannot close without someone outside HR confirming camera data was checked.

The form captures the response. What determines whether a request is answered in full is whether the search reaches systems outside the privacy lead's own view.

KnowComply

Holds the request register against the processing register, starts the statutory deadline on receipt, and flags a request approaching it.

KnowHealth

Surfaces occupational health records the moment a request scope could include them, so the search does not stop at the general file.

KnowFleet

Extends the search to telematics and vehicle monitoring data where the requester is a driver or the scope names it.

Ella

Checks a completed search against the processing register for gaps, and raises a request nearing its deadline before it becomes late.

Subject access request

A request from an individual for confirmation that their personal data is processed, access to it, and specified information about how it is processed, made under the access right in data protection law.

Third-party data

Personal data in the response identifying someone other than the requester, such as a colleague named in a note, which must generally be redacted unless disclosed with consent or inseparable from the requester's own data.

Statutory deadline

The legal time limit for responding, typically one calendar month from receipt, extendable in defined circumstances rather than at the responder's discretion.

Exemption

A narrowly defined ground in data protection law for withholding particular material, such as legal professional privilege, applied to that material only, not the whole request.

Monitoring data

Data generated by watching or tracking activity, including CCTV footage, access logs and telematics, which is in scope for a request even though it rarely lives in an HR system.