In practice, honouring those rights can be quite difficult to do. The typical “give me everything you have about me” request can result in a large amount of work for you. It’s hours spent sifting through information, considering whether any exceptions apply and how best to protect the rights of other people who appear in the same information.

Sometimes, of course, it’s necessary to get a law firm involved in that process, especially if the request is part of a wider dispute. But often this simply isn’t cost-effective. A much better approach, in our view, is to plan ahead of time to make sure you can quickly and easily gather the relevant data. This will give you clear checklists and processes to inform how the data is reviewed before being provided to the data subject, without having to rack up a load of lawyer time.

We can help with that. We’ve helped design the subject rights processes for a wide range of businesses, from retailers to online publishers. We also have plenty of experience in advising on how particular exceptions apply, including sector-specific exemptions like the journalism exemption.