Don’t delete data to avoid sar
How to respond to a SAR.
If you receive a Subject Access Request, you need to respond promptly and fully. Some SARs are very annoying! If you use CCTV or phone call recording a SAR can result in a lot of effort but whatever you do not be tempted to delete this data just to avoid the time and effort in responding. You are allowed to follow your standard deletion policy, but you certainly must not delete data to avoid a full response. Rules about SAR replies are complicated so make sure you check your SAR policy or better still just call us for help. You can check the ICO guidance at: ICO SAR Guidance
If you need more convincing then take look at this example, a council worker was fined almost £2000 for deleting a phone recording. This is definitely a bad idea – IN COURT FOR DELETING DATA
Don’t forget that even if you don’t need to pay the ICO fee you will need to complete GDPR and abide by the rules. Our GDPR policies and procedures include a Subject Access Request policy and you can always call us for help. Take a look at our low-cost packs and subscriptions at: Low Cost GDPR
Good luck all.
About the Author
Head of Commercial & Country Manager
Zlatko Delev is Head of Commercial and Country Manager at GDPRLocal, where he leads the company’s commercial strategy and market presence. He brings international experience across sales, marketing, and customer success, along with a legal background from his studies at Iustinianus Primus Law School in Skopje, Macedonia.
Zlatko sits at the front line of GDPRLocal’s client relationships, guiding organisations through the first stages of their compliance journey and helping them understand where they stand and where they need to go on GDPR, information security, and the emerging landscape of AI regulation. His role bridges commercial strategy with practical data protection knowledge, ensuring clients get clear, actionable direction from their very first conversation with GDPRLocal.
Alongside his commercial focus, Zlatko has trained extensively in project management and organisational leadership, including risk management, stakeholder communication, agile methodology, and digital marketing, a broad skill set that supports his structured, delivery-focused approach to growing GDPRLocal’s business internationally.