Course Description
Subject Access Requests (SARs) are a core right under the UK GDPR and Data Protection Act 2018, and responding to them correctly is essential for legal compliance, organisational transparency, and public trust. This training is designed for staff across all sectors – including Government, Healthcare, Education, Finance, and customer-facing services – who are responsible for receiving, processing, or managing SARs.
Handling SARs can be complex, particularly when dealing with third-party data, exemptions, redaction, or sensitive employee information. Staff in these roles often need clear, practical guidance to ensure accurate responses within statutory timeframes. This course supports organisations by giving employees the confidence, skills, and legal understanding to process SARs effectively and consistently.
By building this capability across your teams, your organisation reduces risk, enhances data protection compliance, and fosters a culture of accountability and transparency in personal data handling.
Need More Information?
Who Should Attend
This 1-day training course is designed for employees who regularly handle Subject Access Requests (SARs) and need a deeper understanding of their legal obligations, processes, and best practices. The course is ideal for those new to managing SARs, as well as staff who need a practical refresher on data protection compliance, including the following roles:
- HR professionals handling employee data
- Data Protection Officers (DPOs)
- Compliance Officers and Legal Teams
- IT, Security, and Records Management staff
- Line Managers responding to SARs
- Administrative and Customer Service teams
Course Outline
Handling Subject Access Requests (SARs) correctly is a legal requirement under the UK GDPR and Data Protection Act 2018. This course provides practical guidance on how to receive, assess, and respond to SARs effectively and lawfully, using real-world examples and exercises. Delegates will learn how to identify valid requests, manage verification, locate data, apply exemptions, redact information, and respond within time limits.
The course will cover the following key areas:
- The legal framework for SARs: UK GDPR and DPA 2018
- Recognising valid SARs and acknowledging requests
- Verifying identities and managing third-party requests
- Locating and retrieving personal data
- Understanding exemptions and redacting information
- Drafting compliant responses in the correct formats
- Managing complex or sensitive requests confidently
- Handling complaints, appeals, and ICO investigations
- Building an audit trail and promoting a culture of data protection