Skip to main content

Subject access request self serve

The following information might help answer your question

You must provide personal information which is held on personal equipment of your staff (including individual contractors) and your processors’ staff, if you remain the Controller of that data. 

This includes where staff are using their smartphones, home computers, private email accounts or private instant messages for work purposes.

We do not expect you to instruct staff to search their personal equipment or private emails or instant messaging applications in response to a SAR, unless you have a good reason to believe they are holding relevant personal data.