Quality Waste Subject Access Request (SAR) Response Procedure

Subject Access Request (SAR) Response Procedure Last updated: July 30, 2024

1. Receiving the Request

• Acknowledgment: Upon receiving a SAR, acknowledge the request in writing within 3 business days. Use Quality Waste’s standardised acknowledgment template.
• Record the Request: Log the SAR in the SAR register, including the date received, the requestor’s details, and the deadline for response.

2. Verify the Identity of the Requestor

• Identification: Verify the identity of the individual making the request. If the requestor’s identity is unclear, request additional identification, such as a government-issued ID.
• Third-Party Requests: If the SAR is made by a third party on behalf of someone else, ensure that valid authorisation documents, such as a power of attorney, are provided.

3. Clarify the Request (if necessary)

• Scope of the Request: If the SAR is broad or unclear, contact the requestor to clarify the specific data they are seeking. Document any clarification.
• Extensions: If the request is complex or numerous, inform the requestor that an extension of up to 30 additional days may be needed, explaining the reason for the delay.

4. Locate the Data

• Data Sources: Identify all locations where the individual’s data might be held within Quality Waste (e.g., databases, email systems, paper files).
• Search: Conduct a thorough search for the requested data across all relevant systems and records.
• Third-Party Data Processors: If any data is held by third-party processors, instruct them to provide the data in compliance with the SAR.

5. Review the Data

• Relevance: Ensure that the data retrieved pertains to the requestor and is relevant to the SAR.
• Redaction: Redact any data that relates to other individuals (unless they have consented to the disclosure) or any sensitive business information not required by law to be disclosed.
• Exemptions: Identify any data that may be exempt from disclosure under applicable data protection laws (e.g., legal privilege, law enforcement, etc.).

6. Prepare the Response

• Compile the Data: Compile the personal data into a readable and accessible format (e.g., PDF, printed documents).
• Cover Letter: Prepare a cover letter outlining the details of the data provided, any redactions or exemptions applied, and the individual’s rights to further action or complaints (e.g., the right to lodge a complaint with the data protection authority).

7. Send the Response

• Delivery: Send the SAR response securely to the requestor (e.g., encrypted email, secure postal service).
• Confirmation: Request confirmation of receipt from the requestor, where possible.

8. Record Keeping

• Documentation: Keep detailed records of the SAR, including all correspondence, the data provided, and any decisions made regarding redactions or exemptions.
• Retention: Retain SAR records in accordance with Quality Waste’s data retention policy, typically for 5 years.

9. Follow-Up

• Complaints or Appeals: If the requestor is dissatisfied with the response, handle any complaints or appeals in line with Quality Waste’s complaint handling procedures.
• Continuous Improvement: Periodically review the SAR response process to ensure it remains effective and compliant with current data protection laws.

10. Training and Awareness

• Staff Training: Ensure that all relevant Quality Waste staff members are trained on SAR procedures and data protection obligations.
• Updates: Regularly update training materials and staff on any changes in data protection laws or internal procedures.