FOI reference - FOI-224
Date - 12 February 2024
Request
- Please advise how many Data Subject Access Requests (hereafter referred to as SARs) you received and responded to in 2021, 2022 and 2023 relating to employees (past or present) and other requests (for example, customers, general public, service users etc).
The next few questions relate to the SARs process which includes collating (pulling the data together from across your organisation/department), redacting the data, pulling the information/ data together into a response and checking the information before issuing it to the requestor.
- When responding to SARS do you manage the process in-house, or do you outsource the whole or part of the process? And if conducted in house please specify the name of the team/function that is responsible for this part of the process (for example, Data Privacy, HR, etc).
If for example you outsource one type of SAR (for example, employee) but complete others (for example, citizen/customer) inhouse, please provide details.
- Approximately how many working hours does it take to pull together a typical SARs response, this includes the time taken to collate and redact the information, and putting the information together for issuing?
- What is the estimated percentage of handwritten documentation within a typical SAR response?
Response
I confirm that we hold some of the information you have requested, and I have answered your questions in turn below.
We have only been separately recording whether a SAR is from an External or Internal (staff past and present) source since 2022. Therefore, I have provided figures from our management information (MI) in the table below. Please note that we record our statistics on a financial year basis.
| Year | 16/17 | 17/18 | 18/19 | 19/20 | 20/21 | 21/22 | 22/23 | 23/24* |
|---|---|---|---|---|---|---|---|---|
| Internal | - | - | - | - | - | - | 5 | 19 |
| External | - | - | - | - | - | - | 21 | 14 |
| Total | 8 | 12 | 16 | 18 | 31 | 16 | 26 | 33 |
* Figures up to 31 January 2024
All of our SARs are handled in-house by the Data Privacy and Compliance Team and in our resource planning forecast we currently estimate the average handling times for SARs as:
- Internal 64.5 hours
- External 15 hours
For question 4 there is no accurate way to estimate the percentage of handwritten documentation within a typical SAR response. The majority of requests we receive have a specific target or criteria, and only on rare occasions will handwritten documents be in scope.