Data Subject Access Requests

The General Data Protection Regulation (GDPR) provides the right for an individual to receive a copy of the personal data being held by a Data Controller. A Data Subject Access Request (DSAR) is the term for requesting this data.

Who is responsible for controlling client personal data?

Each barrister within Deka Chambers is a separate Data Controller, registered with the Information Commissioners Office (ICO) and has responsibility for responding to a DSAR. However, under a Data Sharing Agreement the processing of the request and coordination with a data subject is delegated to the data lead of Deka Chambers, the Director of Operations (DOO).

Submitting a request

You may submit a DSAR to either the barrister directly, or the DOO gwalters@dekachambers.com. Either way, you will receive an acknowledgement of your request within 72hrs.

Proof of identity

To protect your data, we will require proof of identity. This may be provided at the time of the request or following us requesting it within the acknowledgement. We require two documents:

• The first, must show your full name, date of birth and photographic identification e.g. passport or photocard driving licence
• The second, must be less than 3 months old and confirm your current address.

ICO guidelines provide that the calendar month permitted to respond to a DSAR commences upon receipt of identification. Should identification not be received within 7 days of request your DSAR may be deemed to be rescinded.

The personal information you have provided to us for your DSAR, will be used solely for the purpose of processing your request and will be securely destroyed one month after our response to assist in any subsequent queries you may have.

Redaction and exclusion of data

Before issuing the response, it will be reviewed, redacted, or edited to ensure it:

• Is complete.
• Does not infringe the rights of another data subject.
• Is not protected by legal privilege.

Our response

We will provide a response electronically using a password protected secure link.

You should provide an email address to which the response may be sent. By giving this email address you are confirming that you accept responsibility for delivery of your personal data in this way. If this is a shared email address the Data Controller cannot accept any responsibility or liability for 3rd party access and/or further dissemination of your personal data.