11 December 2023

Top Tips for dealing with DSARs and FOIs

By: Becky Hall, Information Governance Manager

A person can request to see information held by an organisation for any number of reasons – and they don’t have to give a reason why.

Sometimes those who request information are feeling vulnerable and are seeking to understand what data is held about them or what is happening within an organisation. Honouring their right to access data can make people feel heard and respected. It also gives them an element of autonomy that they may feel like they have lost.

There are several avenues for requestion and accessing information.

Accessing their own personal data: Data Subject Access Request (Data Protection)

Under data protection law, individuals have rights in relation to data held about them.  Usually, they should receive a response from the organisation within one calendar month of their request being received.

Accessing public sector organisational information: Freedom of Information Act (FOIA) and Environmental Information Regulations (EIR)

Individuals also have the right to request official information from public bodies Under the Freedom of Information Act (FOIA) and Environmental Information Regulations (EIR).  In these instances, the deadline is 20 working days to generate a response. If FOI applies to your organisation, it worthwhile reviewing your publication scheme on a regular basis. This will ensure that to it still links to current information and that this information is updated as necessary.

Your organisation can support people making these two kinds of requests by ensuring good communication at all stages of the process, especially if you are unable to meet the deadline or need to extend it for any reason.

Individuals requesting data may be feeling heightened emotions. It is worth considering how someone who has just been made redundant might feel or someone who feels that they were let down by a service they have accessed. They are likely to feel confused, hurt and their perception of your organisation may be negatively impacted. This can create a cycle of escalation as the requester and the responder reply in a more emotional state each time.

Communication style and language should, where possible, be tailored to the individual to make sure that they fully understand the process and the response. After all, most people who request data don’t work with FOI, EIR, or data protection law daily and the use of excessive legal phrasing can be off-putting and further damage the relationship they have with your organisation.

Getting your response to a request right the first time isn’t all about saving time and resources. If you interact with the requester with compassion and courtesy, it will help you avoid the need to repeat the process or deal with a complaint while upholding the rights that matter to individuals.

It is important that people feel supported and not seen as an inconvenience, especially if they have a history of making requests that are excessive or vexatious. Afterall, each request needs to be viewed on an individual basis. Getting the response right the first time can also limit damage to the relationship between your organisation and the requester, which may also help prevent negative publicity.

Organisations should have a clear process for handling requests. The process should outline everything, from the person responsible for acknowledging the request, through to key contacts for certain areas within the organisation. This process will play a major role in ensuring that you respond to requests correctly and in line with the legislation.

Naomi Korn Associates manages FOI and DSAR requests on behalf of a number of our retainer clients including charities health and education providers. You can learn more about our retainer services here.  For further information contact Jess Pembroke, Head of Data Protection at jess@naomikorn.com or +44 2045822230.