GDPR Personal Data Subject Access Request for More Information Letter

GDPR Personal Data Subject Access Request for More Information Letter

An Employer can refuse to comply with a subject access request (in which case it must advise the Employee, within one month of the request, about their right to complain to the ICO or to the court), or it can charge a reasonable fee reflecting the administrative costs of providing the information, if a request is manifestly unfounded or excessive, for example, because it is repetitive.

The third paragraph of this letter gives the Employer the option of charging a fee to comply with the subject access request in this circumstance.

The time limit for responding to a subject access request is one month from the date of receipt. However, if a request is complex, the Employer can extend the time period for response by a further two months.

You will find more relevant documents included in our online toolkit for your use.