How Should Charities Handle Complex Subject Access Requests?

Charities handling complex Subject Access Requests (SARs) need to identify the requester’s personal data while carefully considering third-party information, safeguarding concerns, confidentiality and any exemptions that apply.

• Complex charity SARs often involve third-party data and safeguarding information.
• Redaction should protect other people’s personal data without unnecessarily removing the individual’s information.
• Whistleblower, multi-agency and child SARs may require additional consideration.
• Assess the scope and circumstances of each SAR on a case-by-case basis.

How Should Charities Handle Third-Party Data in SARs?

Third-party data in a charity SAR should be considered separately from the individual’s own personal data, with relevant information redacted where disclosure would unfairly reveal another person’s information. Failure to redact third-party information effectively could lead to a data breach.

How Do You Redact Third-Party Information in a Safeguarding File?

Safeguarding records may contain the individual’s information alongside information about beneficiaries, family members, staff or other individuals. Charities should first assess which information is not the individual’s, then redact it using appropriate software, or use a SAR support service that offers review and redaction services.

Do personal WhatsApp messages or private emails need to be included?

Communications on a private account or messaging platform are not automatically excluded. If they have been used to discuss charity business and may contain relevant personal data, then they should be included in the SAR. Charities should focus on identifying relevant records and assessing them appropriately.

How Should Charities Handle Safeguarding and Whistleblower SARs?

Safeguarding and whistleblower SARs require careful consideration because disclosure may expose another person or compromise sensitive information.

How do you protect a whistleblower when their information appears in a SAR?

Where the individual is an alleged perpetrator, and the file contains whistleblower information, charities can either redact the whistleblower’s personal information or apply relevant exemptions (such as mixed personal data or confidentiality rules) under data protection laws.

If disclosing those documents would breach legal confidentiality obligations or compromise a protected public-interest disclosure, then you have grounds to apply exemptions.

Should a charity disclose a full multi-agency meeting record?

When a meeting involves the council, the police and the charity, for example, it can be tricky to understand what can be disclosed. Charities should consider both third-party information and their own records rather than assuming the entire document must be disclosed.

When Can a Charity Limit or Refuse a SAR?

A charity may be able to limit or refuse disclosure in specific circumstances, but this depends on the nature of the request, the information involved and the relevant legal requirements.

What should a charity do when a former volunteer submits a SAR after a dispute?

Respond as normal. A dispute doesn’t automatically remove the right of access, so charities should focus on identifying the individual’s personal data and considering any applicable exemptions.

When is a repeat SAR manifestly excessive?

A repeat SAR is manifestly excessive when it duplicates the contents of a previous request and a reasonable interval has not passed, or when it substantially overlaps with pending requests without any change in circumstances, new data or a legitimate reason from the individual.

It’s not excessive if the previous response was mishandled or if new information has come to light.

Who can make a SAR for a child or another person?

A SAR for a child, or another person, can only be made by a third party with the appropriate legal authority or clear consent. For example, for a child under the age of 12, a person with parental responsibility can make the SAR on their behalf, provided it is in the child’s best interests. Charities should weigh up confidentiality, court orders and the child’s welfare before releasing anything.

When it comes to making a SAR for another adult, any adult can submit a request, provided they have proof of authorisation or consent from the data subject. If the adult lacks the mental capacity to manage their own affairs, a registered Lasting (or Enduring) Power of Attorney can cover property, financial or health matters. Alternatively, a person who has been formally appointed by the Court of Protection can put in a request on their behalf.

What Should Charities Check Before Responding to a Complex SAR?

Before responding, charities must check:

• Identity and authority – Confirm the individual’s identity or ensure that a third party has the correct authorisation.
• System check. Charities should search all digital, physical and third-party platforms where data might reside, including emails, case management systems and donor databases.
• Clarification needs. Decide whether the request is broad or ambiguous, and if appropriate, contact the individual to narrow the scope (without breaching statutory rules).
• Third-party data and redaction. Identify and redact information belonging to other individuals.
• Statutory exemptions. Review whether any specific exemptions apply and document the rationale for any withheld data.
• Extension timeline. Assess whether a two-month extension is needed due to complexity, but remember to inform the individual within the initial one-month window.

Get Charity SAR Support With Data Protection People

We understand the pressures charities face when it comes to complex SARs. Whether it’s tight budgets, small teams or both, we can help support charities in a number of areas, including e-discovery of relevant documents, review and redaction or optimising processes within your team. Get in touch today.