Blog

A Subject Access Request (SAR) – also known as a “Data Subject Access Request” – is a formal request made by an individual to an organisation, requesting access to the personal data that organisation holds about them. Under data protection law, including the UK GDPR and Data Protection Act 2018, every individual has the right to know how their information is being used, stored, and shared.

In the majority of cases, responses to Data Subject Access Requests (DSARs) must be completed within one month after a request has been received with all of the required identification information. However, DSAR responses can be extended by two months for complex or multiple requests. 

A Data Protection Officer (DPO) is a mandated role under both the EU and UK GDPR for certain organisations - notably public bodies and those that process large volumes of sensitive personal data. As an independent advisor, the DPO interprets legal obligations, identifies and mitigates data-protection risks, and ensures the organisation can demonstrate clear accountability for how personal data is handled. 

Organisations that are required - or elect - to appoint a Data Protection Officer (DPO) face an important choice: recruit an internal DPO as a permanent member of staff, or consult an external provider to deliver the role on an outsourced basis. Internal appointments involve salaries and training commitments, while outsourced DPO services are typically offered under fixed-fee or retainer arrangements that combine expertise, scalability, and continuity.

At a Glance…

• A DPO is mandatory under the GDPR for organisations engaged in large-scale monitoring, those processing special category or criminal data, or public authorities
• Voluntary appointments are encouraged for organisations wanting to demonstrate accountability and strengthen their data protection practices
• Outsourcing a DPO is a practical solution for many businesses, offering flexibility and compliance support without the burden of internal resourcing

The UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 set stringent rules for handling personal data, and non-compliance can lead to both large fines and reputational damage. To meet these requirements, many organisations (especially large-scale processors of sensitive data, those conducting systematic monitoring, and public bodies) must appoint a qualified Data Protection Officer (DPO).

In a previous blog post, we briefly outlined the plans of the European Union (EU) to facilitate access to high-quality data for scientific research. Three main EU initiatives aim at enabling such access. The first initiative focusses on the establishment of a network of common European data spaces that will intermediate pooling and shared use of data among EU-based organisations in various sectors (e.g. health, energy, agriculture, finance).

Scientific research is front and centre in innovation policies across Europe, and the European Union (EU)'s research agenda makes no exception. In April and May alone, the EU announced its plans to boost research efforts and collaborations, to facilitate access to high-quality data for innovation and to support the development of home-grown artificial intelligence (AI) models and applications.

In a previous blog post, we outlined the typical privacy and data protection implications of conducting biomedical research using personal data from health databanks. These implications relate to the reliability of anonymisation, valid grounds for the reuse of health data, transparency and disclosure, data minimisation, adequate privacy safeguards for harm prevention, and the use of predictive analytics and artificial intelligence.

In early April this year, Prime Minister Starmer announced the UK government's plans to boost biomedical research by ensuring access to large sets of health data. A Health Data Research Service will be set up and host data from various divisions of the National Health Service (the “NHS”). The Health Data Research Service will provide “a secure single access point to national-scale data sets” and help expediate biomedical research.

Artificial intelligence (“AI”) literacy is a new buzz word in the AI and data governance domain. The reason for this increased focus? A wave of regulatory guidance and requirements in the UK and the EU effectively makes AI literacy a must-have for organisations that develop, deploy, or use AI. Beyond simply upskilling staff, AI literacy offers a significant advantage: it enables core functions to effectively screen, detect and manage AI risks, ensuring compliance with the relevant regulatory requirements.  

Navigating the world of AI regulation can feel like a maze. Transparency is key, and two major pieces of legislation – the EU AI Act and GDPR – are essential guides. This article breaks down the core transparency requirements, focusing on what really matters for in-house counsel. The AI Act focuses on making sure people are aware when they're interacting with AI. Many of the specific transparency obligations under the AI Act are derived from Article 50, which focuses on information requirements for providers and deployers of AI systems.