This course provides a practical, step-by-step guide to handling Subject Access Requests (SARs) and requests for erasure under UK GDPR, with a particular focus on the issues that commonly arise in legal practice.
The session explains what constitutes a valid SAR or erasure request, the statutory time limits, and how to respond lawfully while protecting legal professional privilege, confidentiality, and third-party rights. It will explore common problem areas for small firms, including requests made by former clients, opposing parties, employees, or individuals involved in contentious or emotionally charged matters.
Participants will learn how to scope and manage requests proportionately, apply exemptions correctly, document decisions, and communicate clearly with requesters. The course also covers how SARs intersect with complaints, litigation, and regulatory scrutiny, and how poor handling can escalate risk unnecessarily.
Target Audience
- Partners, directors, and owners of law firms
- Compliance Officers for Legal Practice (COLPs) and Compliance Officers for Finance and Administration (COFAs)
- Practice managers and office managers
- Solicitors, fee earners, and administrative staff involved in handling client data
This course is particularly relevant for firms with limited in-house data protection expertise.