If a company has not responded to your GDPR subject access request (SAR) within the required timeframe, there are several steps you can take to prompt a response and ensure your rights are upheld:
1. **Follow Up**: If the initial 30-day response period has passed, we recommend sending a follow-up communication to the company, reminding them of your SAR and requesting an update on the status of your request. Include details such as the date you submitted the SAR and any reference numbers provided by the company.
2. **Escalate Your Concerns**: If the company still does not respond or provide a satisfactory explanation for the delay, consider escalating your concerns to a higher authority within the organisation, such as a supervisor, manager, or the company’s Data Protection Officer (if they have one). Clearly outline your expectations for a timely response and the consequences of non-compliance with GDPR requirements.
3. **Invoke Your Rights**: Remind the company of their obligations under the GDPR and your rights as a data subject. Specifically, highlight the requirement for companies to respond to SARs without undue delay and within one month of receiving the request, unless there are exceptional circumstances.
4. **Request Assistance from the ICO**: If the company continues to disregard your SAR or fails to provide a satisfactory response, you have the right to lodge a complaint with the relevant data protection authority, such as the Information Commissioner’s Office (ICO) in the UK. The ICO can investigate your complaint and take enforcement action against the company if they find that GDPR violations have occurred. (see the link to the ICO at the top of this page)
5. **Consider Legal Action**: As a last resort, you may choose to seek legal advice and consider taking legal action against the company for non-compliance with GDPR requirements. This could involve initiating legal proceedings to compel the company to respond to your SAR and provide the requested information, as well as seeking compensation for any damages or losses suffered as a result of the company’s failure to comply.
It’s important to document all communication with the company regarding your SAR, including dates, times, and any responses received. This documentation will be valuable if you need to escalate your concerns to the ICO or pursue legal action. Additionally, remain persistent in advocating for your rights and don’t hesitate to seek assistance or guidance from relevant authorities or legal professionals.