United Kingdom: Adopted ICO Guidelines on responding to subject access requests

On 24 May 2023, the Information Commissioner's Office (ICO) adopted Guidelines on responding to subject access requests, outlining penalties that employers face in case of non-compliance. The Guidelines are addressed to employers that process subject access requests (SAR) for personal information in the company, provide information on when to comply with a SAR and the information that can be disclosed. The individuals have the right to obtain personal information such as absences, personal development, presences and further information on how the data was obtained and shared with third parties. The Guidelines note that entities have to comply with SAR requests no later than one month.