Print this Page
glossary of terms
Subject Access Request (SAR)
table of contents
Close this Page

Subject Access Request (SAR):
1. The company have a legal obligation to grant every business associate and public person with a Subject Access Request (SAR) process.
2. The SAR process includes:
  (1) Contact-Us public message service so people may register an electronic request for access to their Personally Identifiable Information (PII).
  (2) When the person registers their SAR, they are assigned a unique access code.
  (3) The person may use the Subject Access Request web site to identify themselves and enter their access code.
  (4) The person is granted access to facilities that reflect all legal obligations as below.
3. When a person is identified, they have the legal right:
  (1) To view all their information and information about them as GDPR Article 15
  (2) To correct any information that they deem to be incorrect as GDPR Article 16
  (3) To download any information about them as GDPR Article 20.
  (4) To delete any information about them - the right to be forgotten as GDPR Article 18.
  (5) To object to their information being processed as GDPR Article 21.
  (6) To restrict to their information being processed as GDPR Article 18.
  (7) To stop to their information being used in automatic decision making as GDPR Article 22.
4. This SAR process is limited to information known to the Bespoke Application Service (BAS).   The Owner shall have responsibility for providing a similar service for data stored on local computers and in emails.
5. A business associate is any customer or supplier contact name or approved person even after they have left.   It also includes millions of other people who have the right to make a SAR where the company have a legal duty to respond within a reasonable number of days.   A company may expect a very large number of fake SAR messages and may need special facilities to find PII hidden in emails and old spreadsheets.
6. This SAR process exists because 99% of all SAR messages are expected to be fake, so it is very hard to stay legal and identify those one percent of real SAR messages.   Class actions for compensation is expected to become a massive business.   People have 3.3 million UK companies to make a SAR to with an expectation that 50% may not respond and can be sued for compensation.   Every company that shows it is not prepared with a SAR registration form on their web site is likely to worth trying for SAR compensation.

Privacy Notice:
1. The company have a legal obligation to ensure that every business associate has knowledge of and access to the company privacy notice.
2. People have the legal right to be able to contact the Data Protection Officer to ask any question regarding their data protection concerns.
3. The contact-Us public message service is provided to conform with this legal obligation.

Postal SAR:
1. Where a SAR is made by post or email, an automated reply is generated to request the person to register for the online SAR service.
2. In a few genuine cases, the SAR will be automatically transposed as a registered SAR and then processed in the normal way.
3. An assumption must be that most SAR messages are fake phishing attacks to gather PII and to find out who are customers and who are not.
4. Validation with precision is mandated to ensure that real PII is not disclosed to an imposter as a data breach.

Document Control.
1. Document Title: Subject Access Request.
2. Description: Bespoke Application Service: Subject Access Request.
3. Keywords: Bespoke Application Service, Subject Access Request.
4. Privacy: Shared with approved people for the benefit of humanity.
5. Edition: 1.1.
6. Issued: 2 Jan 2018.