gdpr england-and-wales subject-access-request
Incomplete/unserviceable SAR submissions and deletion timeframes
<p>Bob was party to an incident in a shop that keeps CCTV footage for 30 days. 28 days later he submits a request for this responsive footage, but neglects to include with it adequate selfidentification materials like license or proof of address.</p>
<p>Two slightly different questions here which I think are similar enough to be asked in a single post:</p>
<p>Suppose they have a SAR processing backlog of 3 days by which time the data will have been deleted. Do they have why duty to first preliminarily review any requests and triage them by material auto deletion date?</p>
<p>And secondly, forgetting any processing backlog related lead times, remembering that Bob had failed to include adequate identification proof to satisfy the data controller's procedures, must they make efforts to preserve the responsive materials even if they feel that they cannot yet responsibly disclose them to Bob while his request pends due to inadequate identification?</p>

<p>As I understand it there is no obligation to 'triage' SARs or keep data 'just-in-case' that would otherwise be deleted as a matter of routine.</p>
<blockquote>
<p><strong>Can we amend or delete data following receipt of a SAR?</strong></p>
<p>It is our view that a SAR relates to the data you held at the time you
received the request. However, in many cases, routine use of the data
may result in it being amended or even deleted while you are dealing
with the request. So it is reasonable for you to supply the
information you hold when you respond, even if this is different to
what you held when you received the request.</p>
<p>However, it is not acceptable to amend or delete the data if you would
not otherwise have done so. Under the DPA 2018, it is an offence to
make any amendment with the intention of preventing its disclosure.</p>
</blockquote>
<p><a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/" rel="nofollow noreferrer">https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/</a></p>
