Q&As

What makes a data subject access request ‘complex’?

read titleRead full title
Copyright © 2025 LexisNexis
Published by a LexisNexis Risk & Compliance expert
Published on: 10 November 2020
imgtext

The General data protection Regulation (GDPR) provides for enhanced rights for data subjects in the EU including providing rights of access, rectification, erasure and restriction of processing, data portability, a right to object to processing and a right not to be subject to a decision based solely on automated processing, including profiling, with strict time limits for complying.

What is a data subject access request?

Article 15 of the GDPR provides that the data subject has the right to obtain confirmation from the data controller as to whether or not personal data concerning them is being processed, and where it is, access to the personal data and certain further information—see Practice Note: Data subject rights—access—The right of access—what is it and when does it apply?

You must respond to the data subject without undue delay and in any event within one month of receipt of the request, or within one month of receiving:

  1. •

    any information you have requested to confirm the requester’s identity

  2. •

    any fee you have

Powered by Lexis+®
Jurisdiction(s):
United Kingdom
Key definition:
Data protection definition
What does Data protection mean?

In an employment context, this refers to the obligation on an employer to protect the data of its employees and ensure that it complies with the law on how it uses the employees' data.

Read more readmore

Popular documents

UK GDPR—the basics

UK GDPR—the basicsThis Practice Note explains, in simple terms, the key features of the UK General Data Protection Regulation (UK GDPR). See also Precedent: Data protection quick reference guide.This Practice Note is intended for non-privacy specialists and there are separate, more detailed,

Public statement on data breach

Public statement on data breachStatement by [insert name of organisation] concerning a significant [cyber-attack OR data protection breach] on [insert date].On [date], we were made aware of an incident threatening the security of personal data for which we are responsible. [We OR [insert name of

If a multinational company with entities in a number of EU states has registered a data protection

If a multinational company with entities in a number of EU states has registered a data protection officer (DPO) with the Information Commissioner’s Office (ICO), does it need to register a DPO in the other EU states where it has entities or is registration in one country sufficient?Under Article 37

Refusing a data subject request—what is ‘manifestly unfounded or excessive’?

Refusing a data subject request—what is ‘manifestly unfounded or excessive’?The General Data Protection Regulation (GDPR) provides for enhanced rights for data subjects, including providing rights of access, rectification, erasure and restriction of processing, data portability, a right to object to