Answer a subject access request

Information governance, information security and data protection officer: Answer a subject access request. Starts when: A person asks for their personal data. Steps: Log and verify identity; Search systems; Redact third-party data; Respond within one month or extend by two months with reasons. Done when: The response is sent within the time limit and the case shows what was searched and withheld. Rules that apply: UK GDPR Articles 12 and 15.