Looking for answers
Ask a question

What is a Subject Access Request (SAR)?

A Subject Access Request (SAR) is the right of an individual to request any 'personal data' we hold for them. This right is a principle of the General Data Protection Regulation, designed to regulate the processing of information from which a living individual can be identified or singled out either from the information on its own or when combined with other information.

As part of a SAR, individuals have a right to:

  • a description of the information held about them
  • be informed of the purposes the information is used for
  • be informed of the disclosures that are made or might be made
  • be informed of the source of the information,
  • Be informed of the envisaged retention period for the data
  • Be informed if their data is transferred internationally, who the recipients are, and what the adequacy mechanisms for those transfers are
  • Receive a copy of their personal information.

Examples of Personal Information you can request

The following are examples of personal information (assuming that the information in question can be linked to an identifiable, living individual):

  • contact details
  • CCTV footage
  • Complaints or customer service notes
  • Customer bank statements or related static data (e.g. the content of application forms)
  • Customer medical history
  • Customer spending preferences
  • Customer work experience history (e.g. we may hold evidence of qualifications referenced in a CV submitted to support a business lending application)
  • Employee salary details
  • Notes of meetings from employee disciplinary/grievance hearings
  • Telephone call recordings
  • Please note: The bank has a tight regulatory deadline of 30 days to meet so identifying these requests within business as usual processes and is vital in assisting us in meeting this timeframe. If you require more information about the Act and their rights, you can contact the Data Protection Office (DPO).
  • Below is a timeline to highlight the process of how a SAR is dealt with till you, the customer will receive their final outcome.