An interesting question was asked of us recently, whether a subject access request only applies to information which names the data subject. The short answer is ‘not necessarily’ so let’s look at an example.
Imagine that the minutes of a meeting refer to a person not by name, but by their job title. According to the definition of personal data from the ICO website, “‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it…
It’s the phrase ‘directly or indirectly’ that is helpful here, as in our example, there is only one person at the charity with the named job title. So, indirectly, the job title in this context will identify the individual.
This does illustrate how careful you need to be when dealing with Subject Access Requests, and we hope you have a clear and up-to-date policy supported by some training. The ICO has a wealth of good guidance, and you might start with https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/.