Section 7 of Data Protection Act 1998 enables individuals to request a copy of the information that an organisation is holding about them. This is called a Subject Access Request, or SAR, and must be responded to within 40 calendar days.

In a recent trend, SARs are being used more and more as an evidence gathering tool - before litigation formally kicks off. Depending on the amount of data, responding to an SAR can cause a serious headache to the organisation involved.

The recent story of Jess Varnish, the London Olympics 2012 track cyclist who made an SAR to British Cycling following allegations of sexism is one example. Varnish made nine allegations against Shane Sutton, British Cycling's former technical director. Sutton was subsequently cleared of using sexist language in eight out of nine of them.

Whatever the outcome with Varnish, it is important to remember that written communications regarding individuals may tarnish your organisation’s reputation or ability to defend litigation at a later date.