Blog

<figure id="figure-3bxytj1cxkm0lhuecq" class=""><img id="3bxytj1cxkm0lhuecq" src="https://cdn.durable.co/getty/39oVonm2uocDE4q2zmKWVbnPYt97vS8Vjm17WAZoy8sZZlw3GFrMQ4ppFM92bufJ.jpeg" alt="Help, support, advice, guidance, assistance and info crossroad signpost" title="Help, support, advice, guidance, assistance and info crossroad signpost" class="object-cover bg-gray-100 rounded-sm md:rounded-md lg:rounded-lg" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/getty/39oVonm2uocDE4q2zmKWVbnPYt97vS8Vjm17WAZoy8sZZlw3GFrMQ4ppFM92bufJ.jpeg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Navigating Third-Party Data in Subject Access Requests</h2>Introduction Subject Access Requests (SARs) have become a crucial part of data privacy management in today’s digital world. Under the General Data Protection Regulation (GDPR) and similar data protection laws, individuals have the right to request access to the personal data that organisations hold about them. While responding to SARs can be challenging for any organisation, one of the most complex aspects involves handling third-party data. Striking the right balance between transparency and privacy is not just a legal requirement, but also an ethical imperative that can influence trust, reputation, and overall business success.The Challenge of Third-Party Data in SARs When processing a SAR, organisations must ensure they provide the requestor with all relevant personal data while not infringing on the privacy rights of other individuals whose data might also appear within the requested records. For example, an email or document might contain personal information about the requestor and a third party, such as a colleague, customer, employee or vendor. This overlap of data rights and responsibilities poses a unique challenge: How can organisations be transparent with the requestor without compromising the privacy of third parties?Understanding Third-Party Data Third-party data in the context of SARs typically includes information about other individuals that may be intertwined with the requestor's data. This can occur in various forms, such as:Emails or Correspondence. Personal data of third parties might appear in email threads or shared communications. Employee Records: HR files often contain references to multiple employees, making it difficult to isolate an individual without impacting others.Customer Interactions. Customer service logs or transaction histories may include details of multiple individuals and customers. Shared Documents.&nbsp;Collaborative platforms and shared documents often contain information on multiple contributors.Given these scenarios, organisations need to adopt strategies that protect the data privacy rights of all parties while fulfilling their obligations under data protection laws.<h3>Balancing Transparency and Privacy Key Strategies &nbsp;</h3><figure id="figure-l1g7k0l2ybm0lhc1kt"><img id="l1g7k0l2ybm0lhc1kt" src="https://cdn.durable.co/getty/2aSVPfldwvVf4ty6Q8FWsx5spi06lBDcHA7eOd8uayps7cs2JT5iELZjK7GEvSHe.jpeg" alt="Rules and regulations book. Law, rules and regulations concept." title="Rules and regulations book. Law, rules and regulations concept." class="object-cover bg-gray-100 rounded-sm md:rounded-md lg:rounded-lg" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/getty/2aSVPfldwvVf4ty6Q8FWsx5spi06lBDcHA7eOd8uayps7cs2JT5iELZjK7GEvSHe.jpeg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure>Conduct a Thorough Data Assessment1. Before responding to any SAR, it is essential to conduct a detailed data assessment. This involves identifying all the documents and records that contain the requestor’s data and determining where third-party data is involved. Understanding the context in which the data appears is vital to making informed decisions about how to handle it.Organisations should also establish protocols to determine whether the third-party data is relevant to the request or whether it can be excluded or redacted. This step is critical to avoid over-disclosure and to protect the privacy of third parties. 2. Implement Robust Redaction ProcessesRedaction is a key tool in balancing transparency and privacy. When third-party data is present, organisations can redact or mask the irrelevant data to ensure they only disclose the information directly related to the requestor. Redaction should be performed carefully and consistently to prevent accidental disclosures (data breaches).Implementing a standardised redaction policy ensures that all SAR responses are handled uniformly. This policy should include clear guidelines on which types of data can be redacted, the acceptable methods of redaction, a review process to ensure accuracy and prevent re-identification!3. Leverage Technology for Efficient Data ManagementAdvanced data management tools and technologies, such as artificial intelligence (AI) and machine learning, can significantly streamline the SAR process. These tools can help automate the identification and categorisation of personal data, flag potential third-party information, and apply redaction techniques more accurately and quickly than manual processes. AI is increasingly being introduced in software and systems, such as email.Utilising data discovery and classification tools can also improve the organisation’s ability to find all relevant data sets, ensuring comprehensive and compliant SAR responses while minimising the risk of over-disclosure or errors.4. Consult with Lawyer and Privacy ExpertsGiven the complexities surrounding third-party data, consulting with lawyer or data protection expert can help ensure that responses are both legally compliant and ethically sound. Legal experts can provide guidance on the interpretation of privacy laws, especially in complex cases where third-party data is heavily intertwined with the requestor's data.Regular consultations with data protection experts can also help refine internal policies and response strategies, keeping them aligned with evolving legal standards and best practices.5. Develop Transparent Communication with the RequestorOpen communication with the requestor is vital in managing expectations and explaining why certain data has been withheld or redacted. While it is not necessary to disclose specific details about third parties, providing a general explanation for redactions can help build trust and reduce the likelihood of disputes or complaints to the ICO.Organisations should develop a standard template or communication strategy for responding to SARs, which includes an explanation of the organisation’s obligations under data protection laws, the rights of third parties, and the steps taken to balance transparency and privacy.<h3>Practical Scenarios and Solutions </h3><img id="ed5nvlxx6om0lhokdh" src="https://cdn.durable.co/getty/26xSyA71ujTlxzPUDZEsp12gP2wWehU27iC6fwCzfxyiKEoXuPTkEjrYr3V54Giy.jpeg" alt="Compliance theme with blurred city lights" title="Compliance theme with blurred city lights" class="object-cover bg-gray-100 rounded-sm md:rounded-md lg:rounded-lg" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/getty/26xSyA71ujTlxzPUDZEsp12gP2wWehU27iC6fwCzfxyiKEoXuPTkEjrYr3V54Giy.jpeg" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"><h3>To illustrate these strategies in action, consider the following scenarios.</h3>1. Email Threads with Multiple Individuals: An employee submits a SAR requesting all emails they have sent or received. The emails also contain references to other employees. Here, the organisation should redact the names and personal details of other individuals not directly relevant to the SAR request.2. Shared Documents with Third-Party Data: A customer requests access to their communication history with a customer service department, but the records also mention other customers. In this case, the organisation should redact information about other customers to ensure compliance with data privacy laws.3. HR Records Containing Third-Party Data: An employee requests access to their HR file, which includes feedback or performance evaluations mentioning other employees. The organisation must carefully review the records and redact any third-party identifiers or irrelevant details. Conclusion Navigating the complexities of third-party data in Subject Access Requests requires a careful balancing act between transparency and privacy. By implementing a thorough data assessment process, leveraging technology, maintaining clear communication, and seeking expert advice, organisations can ensure they fulfill their legal obligations while protecting the rights of all individuals involved.The challenges are significant, but with the right strategies and tools, organisations can manage SARs effectively and maintain trust with both the requestor and any third parties involved.<h3>5 Key Takeaways for Resolving Third-Party Data Issues in SARs</h3><figure id="figure-nspiefyhdtm0lhclrv"><img id="nspiefyhdtm0lhclrv" src="https://cdn.durable.co/getty/2c3AtAUJOORcePDS34vCZeFWNZAEyjOhSD8XmUUNzmrcuHA98dt1TlGMnCZYcmWX.jpeg" alt="Business people, group celebration and wow, success and peace sign, thumbs up or friends in team building. Happy, excited and diversity women and men in office teamwork, support or thank you portrait" title="Business people, group celebration and wow, success and peace sign, thumbs up or friends in team building. Happy, excited and diversity women and men in office teamwork, support or thank you portrait" class="object-cover bg-gray-100 rounded-sm md:rounded-md lg:rounded-lg" style="aspect-ratio: 16/9; object-position: 60% undefined%;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="60%" data-positiony="undefined%" data-fullwidth="false" data-mce-src="https://cdn.durable.co/getty/2c3AtAUJOORcePDS34vCZeFWNZAEyjOhSD8XmUUNzmrcuHA98dt1TlGMnCZYcmWX.jpeg" data-mce-style="aspect-ratio: 16/9; object-position: 60% undefined%;"></figure>&nbsp; 1. Conduct Detailed Data Assessments. Ensure that all relevant data is identified and third-party data is carefully evaluated for relevance to the request. 2. Use Robust Redaction Processes. Implement standardised redaction policies to protect third-party data while disclosing only the necessary information.3. Leverage Advanced Technologies. &nbsp;Utilise AI, machine learning, and data discovery tools to automate and streamline SAR processes, reducing the risk of errors and non-compliance.4. Seek Expert Guidance. Regularly consult with legal<span style="font-family: inherit; font-size: calc(18px * var(--body-fontSize, 1)); font-style: var(--body-fontStyle, normal);" data-mce-style="font-family: inherit; font-size: calc(18px * var(--body-fontSize, 1)); font-style: var(--body-fontStyle, normal);">or data privacy experts to ensure compliance with evolving data protection laws.5. Maintain Transparent Communication.&nbsp;Clearly explain any redactions or withholdings to the requestor to build trust and reduce the likelihood of disputes.<figure id="figure-oejrko8jn2m641b6p1"><img id="oejrko8jn2m641b6p1" src="https://cdn.durable.co/getty/1ciXbMUzxNKMxSCgWVD2jKTb5Ql0jZDUEg3DJJrvfrToHXxkuMeHH4NsZCKnsqmf.jpeg" alt="Talking with the colleagues" title="Talking with the colleagues" class="object-cover bg-gray-100 rounded-sm md:rounded-md lg:rounded-lg" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/getty/1ciXbMUzxNKMxSCgWVD2jKTb5Ql0jZDUEg3DJJrvfrToHXxkuMeHH4NsZCKnsqmf.jpeg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><blockquote>If all this seems complex or too difficult, remember we can help you at GDPR Compliance Centre. Just get in contact, we are here to help so you can focus on your business operations.</blockquote>

Balancing Transparency and Privacy

<h2>Understanding GDPR Compliance</h2>General Data Protection Regulation (GDPR) is crucial for businesses operating in the UK and EU. Non-compliance can lead to heavy fines and damage to your reputation. Here are the top 10 GDPR compliance mistakes and how you can avoid them.<figure id="figure-zv14i7tppjm0ffei9t"><img id="zv14i7tppjm0ffei9t" src="https://cdn.durable.co/getty/24nOQjwXq08HKqITKOGtUPcewUARzGBG6KRszgcMs9xNv3KtNqVYjrYoEaNr5XBx.jpeg" alt="Get organised, get it done" title="Get organised, get it done" class="object-cover bg-gray-100 rounded-sm md:rounded-md lg:rounded-lg" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="null" data-positiony="null" data-fullwidth="false" data-mce-src="https://cdn.durable.co/getty/24nOQjwXq08HKqITKOGtUPcewUARzGBG6KRszgcMs9xNv3KtNqVYjrYoEaNr5XBx.jpeg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>1. Know your data</h3>Many businesses fail to map or record their data properly. Without knowing what data you have, the type of data, where it is stored and secured, compliance becomes impossible. Create a detailed data map or record to stay on top of your data.<h3>2. Lack of Lawful Basis for Data Processing</h3>You need to know if you can lawfully collect, store and process personal data. Are you relying on contract, legal requirement, consent etc. For example consent is often relied upon. However, failing to obtain proper consent from users can lead to monetary penalties. Make sure your consent forms are clear and easy to understand. Always keep records of consents and regularly refresh or update them.<h3>3. Inadequate Data Protection Policies</h3>Some businesses do not have data protection policies. Many companies publish their Privacy Policy and Cookie Policies on their websites. These policies may need updating. A lack of internal policies can expose you to unnecessary risks. Develop and implement strong data protection policies. Regularly review and update them.<figure id="figure-tt3c44dxwmm0ffejxp"><img id="tt3c44dxwmm0ffejxp" src="https://images.unsplash.com/photo-1603985529862-9e12198c9a60?crop=entropy&amp;cs=tinysrgb&amp;fit=max&amp;fm=jpg&amp;ixid=M3wyNjI5NjF8MHwxfHNlYXJjaHwxNXx8ZGF0YSUyMHByb3RlY3Rpb258ZW58MHx8fHwxNzI0OTQ0NDc1fDA&amp;ixlib=rb-4.0.3&amp;q=80&amp;w=1080" alt="data protection" class="object-cover bg-gray-100 rounded-sm md:rounded-md lg:rounded-lg" style="aspect-ratio: 16/9;" data-mce-src="https://images.unsplash.com/photo-1603985529862-9e12198c9a60?crop=entropy&amp;cs=tinysrgb&amp;fit=max&amp;fm=jpg&amp;ixid=M3wyNjI5NjF8MHwxfHNlYXJjaHwxNXx8ZGF0YSUyMHByb3RlY3Rpb258ZW58MHx8fHwxNzI0OTQ0NDc1fDA&amp;ixlib=rb-4.0.3&amp;q=80&amp;w=1080" data-mce-style="aspect-ratio: 16/9;"></figure><h3>4. Not Appointing a Data Protection Officer (DPO)</h3>Businesses often overlook the need for a DPO. A DPO helps you stay compliant and manage data protection activities/complaints. Appoint a qualified DPO to guide your compliance efforts. In some businesses, having a DPO is a legal requirement. The ICO has a simple test which can help you. If you have a DPO be sure to inform the ICO.<h3>5. Failing to Register with the ICO to Process Personal Data</h3>If you are processing personal data and fail to register with the ICO you may be fined. The current fine is £4350.<h3>6. Failing to Conduct Data Protection Impact Assessments (DPIAs)</h3>DPIAs are essential for identifying risks related to data processing. Conduct these assessments regularly to mitigate risks. Document your findings, &nbsp;actions taken and actions not taken. It is always best practice to record the steps you have taken, everything you have considered, the impact on individuals, new software, technology used, the reasons why and actions not taken.<figure id="figure-d5roaderhm0ffello"><img id="d5roaderhm0ffello" src="https://cdn.durable.co/getty/21VdgzcgUiuyyZ5Yule4QGKlQLego8yA8ZQdvbCVFsMXyL1CTsSTCFN7OJWiw5zD.jpeg" alt="The Concept of Information Stream Moving Through Servers in Data Center" title="The Concept of Information Stream Moving Through Servers in Data Center" class="object-cover bg-gray-100 rounded-sm md:rounded-md lg:rounded-lg" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="null" data-positiony="null" data-fullwidth="false" data-mce-src="https://cdn.durable.co/getty/21VdgzcgUiuyyZ5Yule4QGKlQLego8yA8ZQdvbCVFsMXyL1CTsSTCFN7OJWiw5zD.jpeg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure> <h3>7. GDPR Training</h3>GDPR came into effect on 25th May 2018, so hopefully everyone in your organisation has heard of GDPR. The Data Protection Act 2018 also came into effect on the same day and supports GDPR. Employee training and awareness is a requirement in the regulations. Ensure your staff can recognise a data breach and know who to report it to. Well trained employees can ensure your customers trust your organisation with their data.<h3>8. Overlooking Data Subject Rights</h3>GDPR grants several rights to data subjects, such as the right to access and the right of erasure (also known as the right to be forgotten). Ensure you have processes in place to handle these requests promptly and efficiently. GDPR provides a statutory deadline and failure to comply may lead to complaints to the ICO.<h3>9. Information Security</h3>If you are collecting and processing personal data, it is a legal requirement to keep that data safe and secure. This sounds easy but in today's world there are many people trying to access your data. This maybe for their competitive advantage, like stealing your customers. It may be to cause disruption, hold your data for ransom or to put you out of business. Good information security takes many forms from training employees, controlling access to computer systems and ensuring your IT team utilise cyber security settings to protect your data.&nbsp;<h3>10. Ignoring Third-Party Risks</h3>Third-party suppliers and contractors can pose compliance risks. Ensure that your suppliers and contractors also comply with GDPR can greatly mitigate these risks and prevent data breaches. Include data protection clauses in your contracts, conduct a simple audit or ask your suppliers to comply with a code of conduct.<figure id="figure-xq0zq43dxom0ffenbo"><img id="xq0zq43dxom0ffenbo" src="https://cdn.durable.co/getty/279fmeav2H8xIAzThVvRo1ApyDRiiv8h1mEB6HegkAhVqEc6ReAELsDBPOmAdXW2.jpeg" alt="When the impossible became possible" title="When the impossible became possible" class="object-cover bg-gray-100 rounded-sm md:rounded-md lg:rounded-lg" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="null" data-positiony="null" data-fullwidth="false" data-mce-src="https://cdn.durable.co/getty/279fmeav2H8xIAzThVvRo1ApyDRiiv8h1mEB6HegkAhVqEc6ReAELsDBPOmAdXW2.jpeg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><blockquote>If all of this feels like an unnecessary headache, why not &nbsp;engage a legal, GDPR specialist to help. We have many simple and cost effective solutions to help your business grow and let you relax.&nbsp;</blockquote>

Top 10 GDPR Compliance Mistakes and How to Avoid Them

GDPR Compliance Centre

We provide expert Data Protection Officer (DPO) services to help UK businesses navigate and comply with GDPR requirements. Whether you need ongoing, full-time support or one-off legal advice, our experienced DPOs offer tailored solutions to ensure your data protection practices meet the highest standards. With extensive experience in law and information security, in both the public and private sector. From risk assessments to policy development, we support your business with practical, cost effective solutions to safeguard your business.

Hanken Grotesk

Noto Sans JP

Noto Serif Display

Essential cookies We use a small number of necessary cookies to keep this website secure and working properly. We do not use advertising or analytics cookies. <a title="Cookie Policy" href="https://gdprcompliancecentre.com/cookie-policy" target="_blank" rel="noopener">[Read our Cookie Policy]</a>