Subject access request guidelines changed by ICO
Under the General Data Protection Regulation (GDPR), organisations must respond to a subject access request – a request made by an individual to access their personal data – within one month of receiving the request.
Following a ruling from the Court of Justice of the European Union (CJEU), the time limit has changed to reflect the day of receipt of a subject access request as ‘day one’, instead of the day after (the ICO’s previous guidance).
The change means that the time limit begins on the day a request is received, regardless of whether it is a working day or not. For example, a subject access request received on 3rd September should be responded to by 3rd October.
We hope you enjoyed this article.
Research Live is published by MRS.
The Market Research Society (MRS) exists to promote and protect the research sector, showcasing how research delivers impact for businesses and government.
Members of MRS enjoy many benefits including tailoured policy guidance, discounts on training and conferences, and access to member-only content.
For example, there's an archive of winning case studies from over a decade of MRS Awards.
Find out more about the benefits of joining MRS here.
0 Comments