ICO publishes lessons learned from GMP handling of SARs

The Information Commissioner’s Office (ICO) has published some of the lessons learned following its reprimand to Greater Manchester Police (GMP) for their handling of a backlog in responding to subject access requests (SARs).

Posting on LinkedIn, the ICO outlined how GMP made several changes last year to address the backlog of requests, the oldest of which dated back to 2021.

The SAR statistics provided by GMP showed that in March 2024 there were 1,112 overdue SARs. On 13 September 2024, GMP reported that the backlog of SARs had significantly reduced to 39, and they had reached a compliance rate of 97%.

The significant reduction was driven through a number of actions, including:

• creating a SAR recovery action plan
• appointing a dedicated Complaints Officer
• improving customer handling, including how requestors are kept informed of progress
• reviewing the Information Management process (e.g. how SARs are handled, workload allocation and what level of managerial support required)
• bringing the Data Protection Officer role in-house
• improving staff retention and staff performance
• increasing staffing levels

As a result of the changes, GMP now has better oversight of the SAR process, enabling trends to be monitored and with better-quality assurance checks. They have also appointed an Information Access Unit manager.

The ICO has published comprehensive guidance to help all organisations with subject access requests or right of access: lnkd.in/eYKkES-Q

---

To read similar articles, check out our Leadership channel