& 
Data Subject Rights and Subject Access Requests
Data Subject Rights and Subject Access Requests, online in about 30 to 45 minutes on any device. The course covers the rights, recognising requests, handling a subject access request, exemptions and third parties, and the other rights.
Who it is for
Who this course is for
Staff who may receive or handle requests from people about their personal data, including customer service, HR, reception, managers, admin teams and data protection champions. No previous training is assumed.
- HR, admin and customer service staff
- Data protection and compliance teams
- Managers who receive requests
- Anyone who handles personal data
- Those who respond to subject access requests
Course content
What the course covers
Five short lessons covering the rights people have, recognising a request, handling a subject access request, exemptions and other people, and the other rights, then a 12-question assessment.
The rights people have
Personal data, the eight rights, and why they matter.
Recognising a request
How requests arrive, no magic words, requests through others, and logging.
Handling a subject access request
Time limits, identity, clarifying, searching, fees and the response.
Exemptions and other people
Third party data, redaction, exemptions and requests that can be refused.
The other rights
Rectification, erasure, restriction, portability, objection, automated decisions and complaints.
Outcomes
What you will be able to do
- Explain the rights people have over their personal data
- Recognise a rights request in any form
- Handle a subject access request correctly and on time
- Apply exemptions and protect other people's information
- Respond to the other rights, such as erasure and objection
Your legal duty
The law behind this training
This course is awareness training on individuals' rights under UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, in line with ICO guidance. It is not legal advice. Your organisation's data protection policy and your data protection officer's advice always apply.
One thing to be clear about: a request does not have to use special words or go to a special address. If someone asks for their information, it may be a subject access request, and the clock may already be running. Pass it on straight away.
- UK GDPR
- Data (Use and Access) Act 2025
- Data Protection Act 2018, s173 (offence of altering data to prevent disclosure)
- Data Protection Act 2018
- Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, complaints provisions
Practicalities
How the course works
For employers
Buying for a team
Buying for more than a couple of people is easier on an account: one invoice, licences you allocate as staff join, and a report of who has done what and when it expires.
- One invoice instead of one card payment per person
- Allocate licences as people join
- Completion and expiry reporting for your records
- Bespoke versions written around your own procedures
Data Subject Rights and Subject Access Requests: common questions
About 30 to 45 minutes, with no time limit: start it, pause it, and come back whenever suits. The certificate is issued as soon as you pass the end assessment.
Yes. Each lesson ends with short knowledge checks, then there is a 12-question assessment with a pass mark of 70% (9 of 12). You can retake it as often as you need.
The certificate is valid for 1 year, and we recommend a refresher every year.
Related