Hi,
I have a quick question about SARs - can the subject insist on the information being posted or emailed to them, while accepting the risks involved if the information is sensitive? Or can the data controller insist on the subject attending their premises for an appointment with a senior member of staff?
These aren't medical or financial records.
Thanks!