← Back to Trust Centre

Data Subject Access Request Policy

DPS Compliance Hub

Data Privacy and Data Security Services Limited

Version 1.0 | 10 October 2026

1 Purpose and legal framework

DPS Compliance Hub must facilitate an individual’s right to know whether their personal data is processed, obtain a copy of that data and receive the supplementary information required by law. Requests must be handled securely, fairly and without undue delay. An individual need not explain their reason for asking and must not suffer detriment for exercising this right.

The controller is Data Privacy and Data Security Services Limited, registered in Cyprus under HE 432380, at Griva Digeni, 51 Athineon Court, Office 202, 8047, Paphos, Cyprus. This policy implements EU GDPR Articles 12 and 15 and applicable Cypriot law, including Law 125(I)/2018 as amended. It also implements UK GDPR, the Data Protection Act 2018 and applicable amendments under the Data (Use and Access) Act 2025 where UK law applies.

The DPO records which regime applies to the particular processing; nationality or residence alone does not decide this. EU requirements continue to apply to processing within the controller’s Cypriot establishment. UK procedural flexibilities or exemptions must not reduce an EU entitlement. Where both regimes apply, track both and satisfy each; use the earlier applicable deadline unless legal advice establishes otherwise.

2 Scope and workspace responsibilities

This policy covers website visitor records, enquiries, demonstrations, quotations, prospective customer and partner communications, marketing preferences and privacy case records for which DPS is controller. It applies to staff, contractors and providers handling those records, including personal data in business emails and relevant filing systems.

Workspace policies remain separate. At intake, distinguish customer-controlled workspace content from any records for which DPS is itself controller. For customer-controlled content, notify the relevant customer controller promptly, assist under its agreement and instructions, and do not independently disclose that content. For DPS controller records, DPS must answer its own part. A mixed request must not be rejected or delayed merely because it also concerns a workspace. Verify tenancy and authority before forwarding; never disclose another customer’s content.

3 Roles and accountability

  • Directors resource the process, approve this policy and resolve deadline or compliance risks.
  • The DPO owns each case, decides jurisdiction and lawful restrictions, monitors time limits and authorises the response. A deputy covers absence; obtain qualified advice for uncertain legal decisions.
  • Record owners and IT identify systems, preserve relevant records, conduct searches and provide results by the internal deadline. Providers assist under contractual instructions.
  • All personnel recognise requests, forward them to the DPO within one working day and avoid unauthorised disclosures. A separate reviewer checks the release package wherever practicable.

4 Recognising and registering requests

A DSAR may be oral or written and may arrive by email, post, telephone, a business contact channel or an authorised representative. No prescribed form, fee, reference to GDPR or use of a designated inbox is required. Examples include “send me the information you hold about me” and “can I have a copy of my enquiry records?”. Ask helpful questions if intent is genuinely unclear, without creating unnecessary barriers.

Data Protection Officer (DPO) contact: info@dataprivacyservices.co.uk. Postal correspondence should be addressed to the Data Protection Officer, Data Privacy and Data Security Services Limited, Griva Digeni, 51 Athineon Court, Office 202, 8047, Paphos, Cyprus. No particular channel is mandatory. Staff receiving an oral request must make a dated, accurate note and confirm its substance. Receipt at a normal business contact point is not postponed until the DPO reads or registers it.

Create a restricted case record on receipt. Record the original request, actual receipt date and channel, subject and contact details, controller or processor role, potential jurisdictions, initial due date, case owner and required actions. Acknowledge promptly, with an internal target of three working days. State the understood scope, contact point, expected response date and any justified verification required. Acknowledgement is an internal service target, not a new statutory deadline.

If a request also asks for correction, erasure, restriction or portability, register and assess those rights separately. A UK access clarification pause does not automatically pause other rights. Where the requester has accessibility needs, offer a suitable channel or format and reasonable adjustments.

5 Identity and representative checks

Disclose only when reasonably satisfied about the subject’s identity and the recipient’s authority. Use existing information and trusted contact channels where sufficient. An email address alone may be inadequate for a sensitive disclosure or where there is evidence of compromise. Do not require a passport or utility bill routinely, or ask for identifiers DPS has no means to verify.

If reasonable doubts remain, promptly explain the concern and request only the minimum additional evidence needed. Offer a proportionate alternative where possible. If an identity document is justified, allow irrelevant fields to be obscured, use a secure collection method, record the verification outcome and delete the document when no longer necessary. Do not reveal whether sensitive records exist to an unverified recipient.

For representatives, verify the subject and the authority to make the request and receive the response. A solicitor’s letterhead, employer relationship or workspace administrator role does not automatically establish authority to obtain all of another person’s data. Confirm directly with the subject using a known channel if needed. Assess legal guardianship, capacity and applicable national law for children or persons requiring support; escalate uncertainties.

Where DPS cannot identify data linked to the requester, explain why and invite proportionate information enabling identification. Under Article 11, do not collect new identifying data solely to create an identification capability, but consider information voluntarily provided. Record unsuccessful checks and any lawful closure decision; provide complaint routes. Continue tasks that can safely be performed while verification is outstanding.

6 Deadlines and clarification

6.1 Normal deadline and escalation

Respond without undue delay and normally within one calendar month. Record receipt immediately, including non-working days. Calculate the corresponding date in the following month; where there is no corresponding date use that month’s last day. Apply the relevant legal rule for weekends and public holidays. As an internal safeguard, plan completion before the legal deadline rather than relying on a holiday adjustment.

Set internal search and review deadlines that leave time for checking and secure delivery. The DPO reviews open cases at least weekly and escalates immediately if compliance is at risk. Staff absence, workload, awaiting a processor or poor record organisation do not automatically justify an extension.

6.2 UK requests

For UK GDPR processing, calculate the response period under Article 12A using the relevant start date where reasonably necessary identity or representative-authority information, or a lawfully chargeable fee, is outstanding. Seek it promptly, record the reason, and do not manipulate the start date to gain time.

Where clarification is reasonably required to identify the requested personal data or processing, the UK access clock can pause from the date clarification is requested until the date the reply is received, inclusive; it resumes the next day. Explain the pause and revised date. A question about delivery format does not justify this pause. If the requester repeats an all-data request or declines to narrow it, proceed with the required searches.

Provide supplementary information that can reasonably be supplied without clarification within one month of receipt. Do not withhold readily available rights and complaint information merely because another part of the response is paused. Keep a calculation showing the original due date and each valid pause. If there is no reply, allow a reasonable, accessible opportunity to respond before any justified closure.

6.3 EU requests and combined cases

Maintain the EU Article 12 deadline from receipt. The EU GDPR has no equivalent blanket UK clarification stop-clock rule. Seeking a narrower scope does not suspend the EU deadline or compel the individual to narrow it. Continue work on the original scope unless the person validly specifies otherwise. Any effect of necessary identity checks on EU timing requires a documented legal assessment; do not automatically reset the clock using UK rules.

6.4 Extensions and non-compliance notices

Where permitted because of complexity or the number of requests, extend by no more than two further months. The DPO must record the specific reasons, notify the individual within the applicable initial month and give the revised deadline. Volume alone is not automatic complexity. For a refusal, fee or other decision not to act, send the required explanation and complaint and judicial-remedy information without undue delay and within the applicable initial month.

7 Preserving and finding personal data

7.1 Preservation and search plan

Promptly preserve information needed to answer the request, particularly short-lived logs. Apply a targeted hold to relevant deletion or overwrite processes and record its scope. Staff must not delete, alter, conceal or manufacture records to frustrate access. Preserve originals; use controlled copies for review. Coordinate any simultaneous erasure request and explain any lawful temporary retention needed to complete the access response.

Prepare a search plan based on the subject’s name, previous names, email addresses, telephone details, organisation, relevant dates and known correspondence identifiers. Identify custodians and repositories rather than searching only the DPO’s inbox. Include shared and individual business mailboxes, enquiry correspondence, calendars, quotation or partner records, any relevant CRM, stored documents, paper files and provider-held technical or security records actually in use. Do not assume a product or system exists merely because it is listed as a possible source.

The website enquiry form currently creates a draft in the visitor’s own email application. A completed but unsent form is not necessarily a record held by DPS. Search received emails and relevant follow-up records; assess separately any retained hosting or security logs. Do not state that no data is held solely because the form does not submit to a server.

7.2 Search standards and evidence

For UK-only processing, carry out a reasonable and proportionate search in accordance with the applicable law and ICO guidance, documenting the systems, effort, likelihood of finding data and any justified limits. For EU processing, do not apply a general effort or cost proportionality carve-out imported from UK law; search the relevant systems and filing systems to identify all in-scope data, subject only to lawful restrictions.

Include personal opinions, assessments, correspondence, identifiers and pseudonymised data that can be linked to the subject. Do not exclude data simply because it is inaccurate, embarrassing, held by a supplier or recorded in an internal message. Remove duplicate copies only where this does not omit substantive content, dates, annotations or meaningful context.

Record search terms, date ranges, repositories, custodians, search dates, results and reasons for exclusions. Where a technical limitation is encountered, seek alternative extraction or provider assistance and escalate; do not treat an unsuccessful keyword search as proof of no records.

7.3 Archives and other controllers

Assess archives, deleted-item stores and backups case by case. They are not automatically exempt. Distinguish data genuinely erased before receipt from data still retained or recoverable. Record the retrieval assessment and obtain advice on any proposed search limitation. Where DPS is a processor for workspace content, perform only authorised tenant-specific searches and supply results securely to the controller within its contractual or agreed deadline. DPS’s own controller response remains separately tracked.

8 Review and lawful restrictions

8.1 Identify what must be disclosed

Review each result to identify the subject’s personal data and the context needed to understand it. Access is to personal data, not an unrestricted right to every business document. Nevertheless, provide document extracts or complete documents where necessary to make the personal data intelligible and faithfully reproduced. Do not replace meaningful information with a vague summary or remove substantive adverse opinions.

8.2 Information about other people

Assess mixed records under Article 15(4) and the applicable national provisions. Identify the actual risk to others’ rights and freedoms. Consider masking names or unrelated passages while retaining the requester’s data and necessary context. For UK cases, assess the relevant Data Protection Act 2018 test, including consent or whether disclosure without consent is reasonable. For EU cases apply the EU balancing standard and applicable law; do not import UK exceptions.

Consent from a third party is not invariably required, and their refusal is not automatically decisive. Do not contact them if doing so would itself create an unjustified disclosure. Record the balancing decision. Trade secrets or intellectual property concerns require a specific assessment and normally do not justify withholding all personal data.

8.3 Exemptions and legal advice

The DPO must approve any restriction with a recorded legal provision, the affected records, factual grounds, necessity and scope. Seek advice where privilege, crime prevention, legal proceedings or a national statutory restriction may be relevant. For UK processing, assess the particular Data Protection Act 2018 exemption and its conditions. For EU processing, identify a valid EU or applicable national restriction, including Cypriot law where relevant; a UK exemption is insufficient.

Confidentiality labels, commercial inconvenience, an ongoing disagreement or the fact that a solicitor is copied into an email are not exemptions by themselves. Apply restrictions only to the information and period justified and release the rest. Explain withheld material as far as lawfully possible without defeating a valid restriction.

8.4 Fees and exceptional refusals

The first copy is normally free. A reasonable administrative fee for further copies, or a fee or refusal for a manifestly unfounded or excessive request, is permitted only where the applicable statutory conditions are met. DPS bears the burden of demonstrating those conditions. Evaluate the individual request and evidence; repetition, hostility, litigation or a broad all-data request is not automatically sufficient. Do not substitute a general “vexatious” test for the statutory test.

Record the decision and any fee calculation; avoid charging ordinary compliance costs as a routine fee. Give written reasons, the controller complaint route, the competent regulator and judicial-remedy rights within the applicable time limit. Do not delay a decision until the response deadline expires.

9 Responses and complaints

9.1 Required response content

The response must confirm whether DPS processes the subject’s personal data, provide a faithful and intelligible copy of the in-scope data and include the following information tailored to that person:

  • The purposes of processing and categories of personal data.
  • Recipients or recipient categories, including recipients in other countries. For EU requests provide actual recipient identities where required by applicable case law, rather than relying routinely on generic categories.
  • The retention periods or the criteria used to determine them.
  • Rights to rectification, erasure, restriction and objection, and the right to complain to a supervisory authority.
  • Available information about sources where data was not collected from the subject.
  • Any relevant automated decision-making, including profiling, with meaningful information about the logic and envisaged consequences where required.
  • The relevant safeguards for transfers to third countries or international organisations.

Provide a no-data response if appropriate, based on documented checks. Explain technical codes and abbreviations. A link to the general privacy policy alone does not replace the copy of personal data or case-specific supplementary information. Distinguish genuinely absent records from information withheld under a lawful restriction.

9.2 Secure release

Use a commonly used electronic format for an electronic request unless the person asks otherwise, and accommodate justified accessibility needs. Independently check the recipient, attachments, scope and redactions. Remove hidden data, comments, tracked changes and recoverable redacted content from disclosure copies without removing in-scope data. Test exports and links. Use risk-appropriate secure transfer and transmit any password by a separate trusted channel. Preserve a record of what was released and when.

9.3 Complaints and errors

Responses must explain how to complain to DPS at info@dataprivacyservices.co.uk or its registered address. Acknowledge privacy complaints within 30 days, investigate appropriately and communicate the outcome without undue delay. Have a reviewer not involved in the original decision where practicable. Correct omissions promptly; report an accidental disclosure through the incident procedure immediately and assess notification duties separately.

Identify the Cyprus Office of the Commissioner for Personal Data Protection at https://www.gov.cy/dataprotection/en/. EU individuals may complain to the competent authority in their habitual residence, workplace or the place of the alleged infringement. For UK matters give the ICO route at https://ico.org.uk/make-a-complaint/. Explain judicial-remedy rights. DPS’s internal complaint process does not remove statutory remedies.

10 Records and oversight

Restrict case files, identity checks, search exports and unredacted records to authorised personnel. Process ordinary DSAR administration to meet legal obligations; assess an additional Article 9 condition or other requirement if sensitive or criminal-offence information is involved. A subject’s access request does not itself justify unrelated use of the resulting information.

Record a justified retention period and deletion date for each case in line with the Website Privacy Policy and approved retention schedule. Consider evidence of compliance, relevant limitation periods and ongoing complaints or legal holds. Do not set an indefinite default. Delete identity-document copies promptly once verification is complete unless a specific lawful reason requires retention. Delete working exports when no longer needed; retain the minimum evidence and response record necessary. Review and release preservation holds after closure.

The DPO reviews this policy at least annually and after legal changes, changes to website enquiry handling, workspace arrangements, audit findings or incidents. Train personnel on recognition, one-working-day escalation, preservation and secure disclosure. Monitor deadlines, overdue cases, complaints, disclosure errors and search quality, and record corrective actions. Supplier agreements must support timely searches and controlled assistance.

11 Case register and release checklist

11.1 Minimum case register fields

Each case must record: case ID; receipt date and channel; requester and subject; representative authority; identity assessment; scope; applicable law and controller or processor role; responsible customer controller where applicable; case owner and reviewer; original and revised deadlines; justified pauses or extensions; acknowledgement; preservation actions; systems and custodians searched; supplier instructions; review and redaction decisions; fee or refusal reasons; approval; release contents, method and date; complaint outcome; retention or hold basis; and deletion date.

11.2 Mandatory release checks

  • Identity, representative authority and disclosure destination are verified.
  • Controller responsibilities and both EU and UK deadlines have been addressed.
  • Relevant systems, custodians and provider-held records have been searched, with evidence retained.
  • The data copy is complete and intelligible within the lawful scope; redactions and restrictions are justified.
  • All required supplementary information and complaint routes are included.
  • Exports are checked for hidden information and redactions cannot be reversed.
  • The DPO has approved release; a separate review is recorded where practicable.
  • Secure delivery, the response date and subsequent case retention are recorded.

12 Standard correspondence

Use these as drafting prompts, completing the case-specific fields and applicable legal analysis. Remove unused options. Do not send a template that promises a deadline inconsistent with section 6. In each template, info@dataprivacyservices.co.uk is the contact address for the Data Protection Officer (DPO).

12.1 Acknowledgement

We received your request on [date] for [scope]. Data Privacy and Data Security Services Limited is handling the parts for which it is the data controller. Our current response deadline is [date]. You can contact us at info@dataprivacyservices.co.uk, quoting [case reference]. [Explain any reasonably necessary verification and its effect under the applicable law.] You do not need to explain why you want access.

12.2 Clarification or extension

To identify [the information or processing], please clarify [specific question]. We need this because [reason]. You remain entitled to request all your personal data. [For a valid UK-only pause, state the pause date and how timing resumes; for EU processing, continue to track the EU deadline.] We will provide information we can reasonably supply without waiting for clarification.

Where a lawful extension is necessary: We need additional time because [specific complexity or number of requests]. We are extending the response period by [period, no more than two further months]. Your revised deadline is [date]. [Provide contact and complaint routes.]

12.3 Completion or partial refusal

We [do/do not] process personal data about you within [scope]. [Provide the data copy and all section 9 supplementary information, or explain the documented no-data result.] [Identify any withheld categories, the applicable legal provision and reasons as far as legally permitted.] If you believe information is missing, contact us at info@dataprivacyservices.co.uk with [case reference].

You may complain to us at that email address or our registered address: Griva Digeni, 51 Athineon Court, Office 202, 8047, Paphos, Cyprus. You also have the right to complain to [competent supervisory authority and current complaint route] and to seek a judicial remedy. [For EU processing, include the alternative competent EU authority routes; for UK processing, include the ICO.]

12.4 Customer controlled workspace data

Your request includes information held in [workspace] for which [customer controller, if safely verified] decides the purposes and means of processing. We have [notified/will assist] that controller under the applicable agreement and instructions. [Give an appropriate verified contact route.] We will separately respond to any personal data for which DPS is controller. [Avoid confirming tenant content to an unverified person.]

13 Legal and guidance references

The DPO must use the current legislation and guidance relevant to each case. These references support interpretation; they do not replace case-specific legal assessment. Legal and guidance review date: 10 October 2026.

EU and Cyprus

Regulation (EU) 2016/679: Articles 5, 11, 12, 15, 23, 28 and 32, and relevant complaint and remedy provisions. Official text: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng

Cyprus Law 125(I)/2018, as amended, including any applicable national restrictions. Commissioner’s legislation page: https://www.gov.cy/dataprotection/en/documents/law-125i2018/

European Data Protection Board Guidelines 01/2022 on data subject rights and right of access, version 2.1: https://www.edpb.europa.eu/system/files/documents/2023-04/edpb_guidelines_202201_data_subject_rights_access_v2_en.pdf

United Kingdom

UK GDPR Articles 12, 12A and 15; Data Protection Act 2018, including applicable exemptions and controller complaint duties; Data (Use and Access) Act 2025 and applicable commencement provisions. Official legislation: https://www.legislation.gov.uk/

ICO right of access guidance: https://ico.org.uk/right-of-access

ICO guidance on responding to requests, identity checks, clarification and time limits: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/

ICO complaint handling requirements and guidance: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/06/new-data-protection-complaints-law-now-in-force/

Internal document alignment

Read with the DPS Compliance Hub Website Privacy Policy and the relevant workspace privacy policy and data processing agreement. The controller’s website privacy commitments, including the enquiry delivery method and complaint contact, must be kept aligned with the operational process. Differences in workspace roles or purposes require separate assessments and do not justify denying access to DPS controller records.