A former employee has requested e-mail correspondence which contains information about her. Do we have to respond to a request from someone who is no longer an employee? If so, there are thousands of e-mails that might contain details which relate to her. Can we take the position that we will not respond to her request because it is too onerous or could we charge her for the work we need to do on responding to her?

Lindsay Gibson writes:

Firstly, any individual can make a Data Subject Access Request (a “DSAR”) to an organisation which processes their personal data. So despite the former employee no longer being employed by your organisation, she still has the right to make a