The Ministry of Defence, Home Office and Virgin Media among the organisations which have failed to respond to Subject Access Request in time, if at all. Credit: Aquir Getty Images The UK’s Information Commissioner’s Office (ICO) has announced that it has acted against seven UK organisations for failing to respond to the public when asked for personal information held about them. Organisations must respond to a Subject Access Request (SAR) under Article 15 of the UK GDPR within one to three months, but an ICO investigation found seven organisations across the public and private sectors repeatedly failed to meet this legal deadline. This has resulted in regulatory action including reprimands as well as practice recommendations issued under the Freedom of Information Act 2000 (FOIA).MoD, Home Office, Virgin Media among reprimanded UK organisationsIn a posting on its website, the ICO stated that the seven organisations were identified following a series of complaints in relation to multiple failures to respond to requests for copies of personal information collected and processed, either within statutory timeframes or at all, breaching the UK GDPR and Data Protection Act. The seven organisations the ICO has reprimanded are:The Ministry of Defence (MoD)The Home OfficeThe London Borough of CroydonKent PoliceThe London Borough of HackneyThe London Borough of LambethVirgin MediaThe ICO has ordered these organisations to make improvements in between three and six months or face further possible enforcement action.ICO will “continue to support” organisations to meet data privacy obligationsInformation Commissioner John Edwards said, “SARs and requests made under FOIA are fundamental rights and are an essential gateway to accessing other rights. Being able to ask an organisation “What information do you hold on me?” and “How it is being used?” provides transparency and accountability and allows the person to ask for changes to be made or even for the information to be deleted.” Edwards said that the ICO will continue to support organisations to meet their obligations to individuals. “This includes developing a SAR generator to help people identify where their personal information is likely to be held and how to request it, at the same time as providing information to the organisation regarding what is required from them. We expect all information requests to be handled appropriately and in a timely way. This encourages public trust and confidence and ensures organisations stay on the right side of the law.” Related content news Top cybersecurity product news of the week New product and service announcements from Coro, Descope, Genetec, Varonis, Cloudbrink, Databarracks, and Security Journey By CSO staff Dec 07, 2023 22 mins Generative AI Generative AI Machine Learning news analysis Attackers breach US government agencies through ColdFusion flaw Both incidents targeted outdated and unpatched ColdFusion servers and exploited a known vulnerability. By Lucian Constantin Dec 06, 2023 5 mins Advanced Persistent Threats Cyberattacks Vulnerabilities news BSIMM 14 finds rapid growth in automated security technology Embrace of a "shift everywhere" philosophy is driving a demand for automated, event-driven software security testing. By John P. Mello Jr. Dec 06, 2023 4 mins Application Security Network Security news Almost 50% of organizations plan to reduce cybersecurity headcounts: Survey While organizations are realizing the need for knowledgeable teams to address unknown threats, they are also looking to reduce their security headcount and infrastructure spending. By Gagandeep Kaur Dec 06, 2023 4 mins IT Jobs Security Practices Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe