Subject Access Requests (SARs) and requests for erasure can present significant practical and compliance challenges for law firms, particularly where issues of legal professional privilege, confidentiality, third-party information, or ongoing disputes arise. Mishandling these requests can lead to regulatory scrutiny, complaints, and increased legal risk.
This practical course provides a step-by-step guide to handling SARs and erasure requests under UK GDPR. Delegates will gain a clear understanding of their obligations, the relevant timescales, and how to respond lawfully while protecting both client interests and the firm’s position.
Through practical guidance, the course explores how to assess, scope, and manage requests efficiently, apply exemptions appropriately, and document decision-making effectively. It also examines the relationship between SARs, complaints, litigation, and regulatory investigations, helping firms minimise risk and respond with confidence.
Topics Covered
- Understanding SARs, erasure requests, and key UK GDPR obligations
- Assessing valid requests, statutory timescales, and compliance requirements
- Managing legal professional privilege, confidentiality, third-party rights, exemptions, and redactions
- Handling requests from clients, employees, and other parties efficiently and effectively
- Navigating the interaction between SARs, complaints, litigation, and regulatory investigations while maintaining clear records and reducing compliance risk
Target Audience
This online course is suitable for partners, directors, COLPs, COFAs, practice managers, solicitors, fee earners, and administrative staff involved in handling personal data. It is particularly beneficial for firms with limited in-house data protection expertise or responsibility for responding to data subject rights requests.