TLDR: Thirdfort explains that it acts as a data processor under UK GDPR, handling personal data only on instructions from professional advisors, who are the data controllers. Data Subject Access Requests (DSARs) must be submitted to the professional advisor, who will respond directly or instruct Thirdfort to do so, ensuring privacy and data security.
Data & Thirdfort
At Thirdfort, we are committed to protecting your privacy and ensuring transparency in how your data is handled. This article explains our process for handling Data Subject Access Requests (DSARs) and clarifies our role in managing your personal information.
Please note that any request to exercise data subject rights, including DSARs, must be directly submitted to the professional advisor (e.g. your solicitor, conveyancer, estate agents etc) who has engaged Thirdfort to carry out verification on you, as they are the data controller.
Data processor vs controller: roles explained
Under the UK General Data Protection Regulation (UK GDPR), Thirdfort acts as a data processor for the information we handle about you, while the professional advisor carrying out checks on you is the data controller. This means:
Your professional advisor (data controller):
- Determines why and how your personal data is collected, used, and stored.
- Decides the purposes and means of processing your personal data.
- Responds to data subject requests, including DSARs.
Thirdfort (data processor):
- Processes your data on behalf of the professional advisor.
- Follows the instructions provided by the professional advisor regarding your data.
- Cannot make independent decisions about the use of your personal data.
Therefore, under UK GDPR, we are only permitted to act on the instructions of the controller. This process ensures that your sensitive information is only released after your advisor has correctly verified your identity, keeping your data secure.
How to raise a DSAR
If you wish to submit a Data Subject Access Request, please contact your professional advisor directly with your DSAR.
Upon receipt of your DSAR and having assessed the validity of the request/requester, your professional advisor may either:
a) Respond to you directly with the requested information, or
b) Instruct us to respond to you on their behalf. If this is the case, we will ensure your request is promptly fulfilled.
We appreciate your understanding of this process, which is designed to protect your privacy and ensure compliance with data protection regulations.
If you have any questions about this process, please don't hesitate to contact our support team.