Skip to main content

Your browser is out of date, and unable to use many of the features of this website

Please upgrade your browser.

Ignore

This website requires cookies. Your browser currently has cookies disabled.

DPA subject access request

FOI reference - FOI-224
Date - 12 February 2024

Request

  1. Please advise how many Data Subject Access Requests (hereafter referred to as SARs) you received and responded to in 2021, 2022 and 2023 relating to employees (past or present) and other requests (for example, customers, general public, service users etc).

The next few questions relate to the SARs process which includes collating (pulling the data together from across your organisation/department), redacting the data, pulling the information/ data together into a response and checking the information before issuing it to the requestor.

  1. When responding to SARS do you manage the process in-house, or do you outsource the whole or part of the process? And if conducted in house please specify the name of the team/function that is responsible for this part of the process (for example, Data Privacy, HR, etc).

    If for example you outsource one type of SAR (for example, employee) but complete others (for example, citizen/customer) inhouse, please provide details.

  2. Approximately how many working hours does it take to pull together a typical SARs response, this includes the time taken to collate and redact the information, and putting the information together for issuing?

  3. What is the estimated percentage of handwritten documentation within a typical SAR response?

Response

I confirm that we hold some of the information you have requested, and I have answered your questions in turn below.

We have only been separately recording whether a SAR is from an External or Internal (staff past and present) source since 2022. Therefore, I have provided figures from our management information (MI) in the table below. Please note that we record our statistics on a financial year basis.

Year 16/17 17/18 18/19 19/20 20/21 21/22 22/23 23/24*
Internal - - - - - - 5 19
External - - - - - - 21 14
Total 8 12 16 18 31 16 26 33

* Figures up to 31 January 2024

All of our SARs are handled in-house by the Data Privacy and Compliance Team and in our resource planning forecast we currently estimate the average handling times for SARs as:

  • Internal 64.5 hours
  • External 15 hours

For question 4 there is no accurate way to estimate the percentage of handwritten documentation within a typical SAR response. The majority of requests we receive have a specific target or criteria, and only on rare occasions will handwritten documents be in scope.