Your device register can tell you who has a company phone. It cannot tell you where every piece of personal information about a worker is held.
Work emails, project records and messages may all need consideration when a subject access request arrives. If information has spread across accounts, devices and informal work channels, finding it can become a coordination job for several teams.
For construction businesses, the useful preparation is to understand those working arrangements before a request needs an answer. Mobile management can support that control, but it does not replace the response process.
Know the duty, then organise the work
A subject access request concerns a person's personal information and associated rights. It is not automatically a right to every complete project document that mentions them. The response owner needs to consider the scope, relevant exemptions and other people's information.
The ICO says organisations must generally respond without undue delay and within one month. Particular circumstances can affect when the period starts, whether clarification pauses it, or whether an extension is permitted. Confirm the deadline for the actual request and record the reasoning. ICO guide to subject access.
The immediate pressure is time. The response team needs to locate and review the relevant information while the people helping it still have their usual work to do.
Start with where people actually work
Agree a search plan with the person leading the response and the relevant colleagues. Do not send everyone an instruction to export everything.
| Possible location | Who may help | What to establish |
|---|---|---|
| HR and employment systems | HR and the administrator | Relevant records, dates and secure extraction |
| Work email and collaboration spaces | IT and account owners | Search capability, access, retention and review |
| Project records and client portals | Project lead and platform owner | Whether the business holds the information and how to obtain it |
| Work-related messages | Relevant staff and the response owner | Approved channels and whether personal accounts were used for business |
| Information held by a processor | Supplier and response owner | The agreed assistance process and timescales |
These are prompts for an agreed search, not a requirement to search every location for every request. The ICO requires a reasonable and proportionate search. Keep the rationale, limitations and further action needed. ICO finding and retrieving information.
A personal device can still matter
Information does not automatically fall outside the response because a phone belongs to an employee. Where staff hold relevant personal information on the organisation's behalf, it may need to be considered. The ICO explains that staff may need to search relevant private devices or messaging applications in appropriate circumstances.
Agree a lawful and proportionate process with the response owner. This is not permission for IT to inspect all of someone's private content.
An illustrative construction example is a supervisor who used a personal messaging account for work-related discussions involving a worker. The response owner needs to decide how relevant information should be identified and reviewed. A managed work app may support separation and control, but it does not collect conversations held elsewhere.
Keep a record that helps coordinate the response
Record enough to manage the work without copying sensitive material into another spreadsheet.
| Field | Useful entry |
|---|---|
| Response owner and deadline | Named colleague and confirmed date |
| Information location | System, account or work channel considered |
| Search owner | Person able to perform or arrange the search |
| Scope and date | Agreed terms, period and work completed |
| Evidence location | Reference to the secure review location |
| Limitations | Missing access, retention issue or supplier dependency |
| Review and follow-up | Who considers other people's information, exemptions and final disclosure |
The technical search and the disclosure decision are separate jobs. IT can help retrieve information; the authorised response owner decides what should be supplied, with appropriate advice where needed.
What EMM helps with
Enterprise Mobility Management can support an agreed work-device and application arrangement: supported devices, controlled work access and defined joiner and leaver actions, depending on the platform and configuration.
It cannot discover all personal information across every system, decide exemptions or make an organisation compliant by installation. It also cannot guarantee deletion of copies outside its control.
The useful connection is preparation. Know the approved work channels, who administers them, what can be retrieved and how the business handles changes of project or employment. That reduces the search for unknown accounts when the response team is already working to a deadline.
Start with one current project. Map its work channels and information owners with IT and the response lead. If ownership and visibility remain unclear, Assured Digital's Data Security & Governance diagnostic offers a structured self-review. It does not assess a legal response or certify compliance.
