Subject access request self serve
-
1. What is your question about?
Third party information (information about other individuals)
-
2. What is your question?
Can I share third party information without consent?
The following information might help answer your question
In practice, the clearest basis for justifying the disclosure of third-party information in response to a SAR is that the third party has given their consent. It is therefore good practice, where possible, to ask relevant third parties for their consent to the disclosure of their personal data in response to a SAR.
However, you are not obliged to ask for consent. Indeed, in some circumstances, it may not be appropriate to do so, for instance where:
- you don't have contact details for the third party;
- it would potentially disclose personal data of the requester to the third party that they were not already aware of; or
- it would be inappropriate for the third party to know that the requester has made a SAR.
To help you decide whether to disclose information relating to a third party, follow the three-step process and make sure you consider all the other factors set out in the guidance.