How UK organisations can receive, verify, search for and respond to subject access requests without losing control of the timetable.
What is a subject access request?
A subject access request (SAR) is a request by an individual for access to their personal information and related supplementary information. A person can make a SAR verbally or in writing, including through social media, and they do not need to use a particular form of words.
The practical challenge is usually not recognising a request. It is coordinating the response across email, HR, customer systems, shared drives, messaging tools and suppliers while protecting other people’s information.
The core deadline
In most cases, an organisation must respond without undue delay and within one calendar month. The ICO’s current guidance explains that the time limit may be extended by up to a further two months where the request is complex or the organisation receives a number of requests from the same person. If an extension is needed, the requester must be told within the first month and given the reason.
The clock may not begin until the organisation has the information it reasonably needs to confirm identity, authority or a required fee. Any request for additional information should be proportionate and made promptly; it should not be used to delay an otherwise clear request.
A reliable response workflow
1. Capture the request. Record the date, channel, requester, scope, identity status and person responsible. Route verbal requests into the same process as written requests.
2. Acknowledge and clarify only when needed. If the request is genuinely unclear and clarification is reasonably required, explain what is needed. Do not pressure someone to narrow a request simply because a broad search is inconvenient.
3. Verify identity proportionately. Request formal identification only where it is necessary to avoid disclosing information to the wrong person. Avoid collecting more identity information than the risk justifies.
4. Map the search. List the likely systems, custodians, suppliers, archives and communication channels. Make a reasonable and proportionate search, and document what was searched and why.
5. Review exemptions and other people’s information. Check whether an exemption or restriction applies and consider the rights of other individuals. Decisions should be made case by case and recorded.
6. Prepare a clear, secure response. Provide the information in a commonly used electronic format where the request was made electronically, unless another format is requested. Use a secure delivery method and make the information accessible.
7. Close the loop. Record the response date, material supplied, redactions or exemptions relied on, and any lessons for future requests.
Common mistakes to avoid
- Treating a SAR as valid only when it arrives through a designated inbox.
- Starting the search too late because teams assume the request will be easy.
- Asking for excessive identification as a routine step.
- Forgetting email attachments, collaboration tools, backups or processor-held data.
- Disclosing another person’s information without considering their rights.
- Missing the deadline because the organisation did not set an internal target earlier than the legal limit.
Make the process repeatable
A short SAR playbook should define intake, identity checks, search owners, review standards, secure delivery and escalation. Training should use realistic examples, particularly for employee requests and requests involving multiple business units.
This article is general information, not legal advice. The applicable response depends on the facts, exemptions and current ICO guidance.
Further reading
- ICO: A guide to subject access
- ICO: Time limits for responding to data protection rights requests