2 min read
What a subject access request can expose about your record keeping
A data subject access request from a client is a legal right under UK GDPR, and it can expose exactly how badly, or well, you keep records. Here's what most contractors don't realise about it.
A subject access request, or SAR, gives any individual the right to ask an organisation what personal data it holds about them and, broadly, how it's being used. It's not exclusive to construction, but it's increasingly turning up in disputes with contractors, usually from a client who's already unhappy about something else and has been advised, sometimes by a solicitor, that a SAR is a useful way to see exactly what's been recorded about them and their job.
For a contractor, the immediate reaction is often confusion, because it doesn't feel like a construction issue. But a SAR covers any personal data, which includes emails, texts, and site diary entries that mention the client by name, photos that identify them or their property in a personal capacity, and notes about interactions and disputes. If a client requests this, you're legally required to respond within one month, and what you produce says a lot about how the job was run.
This cuts both ways. A thorough, professional record, dated entries, factual notes, clear photos, tends to reassure a client or their solicitor that the job was managed properly, even in the middle of a dispute, because it shows a pattern of care rather than chaos. A patchy record, or worse, informal notes that include anything unprofessional, frustrated commentary about the client written for an internal audience that never expected to be read by them, can do real damage to your position, both in the dispute itself and potentially as a separate data protection complaint.
The practical lesson isn't to record less. It's to keep records that are factual, professional, and something you'd be comfortable with the client reading, because there's now a real legal mechanism by which they might. Site diaries and notes should describe what happened, not editorialise about the client's behaviour or attitude, however tempting that is in the moment.
It's also a reminder that scattered records, personal WhatsApp messages, texts on someone's own phone, notes in a personal notebook, are much harder to locate, review, and respond to properly within a SAR deadline than records kept in one organised system tied to the job. Getting this wrong isn't just inconvenient, it can be a compliance failure in its own right.