This clause requires one party to help the other respond when people ask to see their own personal data (a "Subject Access Request" or SAR). Under UK GDPR and US state laws, individuals have the legal right to request copies of data held about them, and companies must respond within 30 days. If you're the data processor (the company handling data on behalf of someone else), you must help the data controller (the company responsible for the data) meet this deadline. Failing to support SARs can result in regulatory fines and damage to your reputation.
Ensure the clause specifies a clear timeline for your support—ideally that you'll respond to requests within 5-10 business days so the other party has time to compile and send the response. Include a cap on the number of free SARs per year (typically 2-3) to avoid unreasonable costs, but make clear you'll still comply with legal requests. Avoid clauses that make you responsible for the final response deadline; that should stay with the data controller. ---
Frequently Asked Questions
What does this clause mean in simple terms?
This clause requires one party to help the other respond when people ask to see their own personal data (a "Subject Access Request" or SAR).
Why should I care about this clause?
Under UK GDPR and US state laws, individuals have the legal right to request copies of data held about them, and companies must respond within 30 days.
What are my options?
If you're the data processor (the company handling data on behalf of someone else), you must help the data controller (the company responsible for the data) meet this deadline.
How does this affect small businesses?
Failing to support SARs can result in regulatory fines and damage to your reputation.