Under the GDPR, a SAR must be complied with free of charge except in circumstances where the request is manifestly unfounded or excessive. However, there is minimal guidance in the Data Protection Bill 2017 as to what types of request would be deemed excessive or unfounded. It is likely that repeated requests for the same information or requests that are “fishing expeditions” would fall under this exception. Nevertheless, until the ICO publishes guidance on this, it cannot be said with any certainty what requests would be excessive or unfounded.

If employers refuse to respond to a SAR, reasons for refusal must be given and the individual must be notified of his/her right to complain to the ICO. Employers should respond to the individual without undue delay but, in any event, no later than one month after the request was made.

Given the lack of guidance at present, employers should respond to a SAR unless it would involve retrieving information that causes significant practical or technical difficulty. Further, the ICO Code notes that employers “should be prepared to make extensive efforts to find and retrieve the requested information.”