An individual can make a subject access request to you verbally or in writing. It can also be made to any part of your organisation (including by social media) and does not have to be to a specific person or contact point.
A request does not have to include the phrase ‘subject access request’ or mention Article 15 of the GDPR, as long as it is clear that the individual is asking for their own personal data. Therefore you may need to consider which of your staff who regularly interact with individuals may need specific training to identify a request.
Additionally, it is important to write and implement a policy for recording details of the requests you receive, particularly those made by telephone or in person.
This FAQ is in these categories: DSAR questions
