If your organisation has received a subject access request (SAR), you have one month to respond. This guide sets out what an SAR is, what you have to hand over, what you can hold back, and how to build a process that copes when requests arrive in volume or alongside a dispute.
What is a subject access request?
A subject access request is a request from an individual asking an organisation for a copy of the personal data it holds about them, along with information about how that data is used.
In the UK, the right is established under the UK GDPR and the Data Protection Act 2018, and organisations handling the data of people in the EU will also be subject to the EU General Data Protection Regulation.
Requests can come from customers, former customers and members of the public, but in practice many of the most demanding ones come from current and former employees.
How long do you have to respond to a subject access request?
You must respond without undue delay and no later than one month from receipt. Where a request is complex, or one person has made several, the deadline can be extended by up to two further months, provided you tell the individual within the first month and explain why.
Extensions are the exception, and they need to be justified. Missing the deadline is a breach of data protection law in its own right. It can lead to a complaint to the Information Commissioner’s Office (ICO), enforcement action and, in serious cases, financial penalties, so a late response tends to create a second problem on top of whatever prompted the request.
The clock pauses while you verify the requester’s identity or ask them to clarify what they are looking for, and restarts once you have the information you need.
How to recognise a subject access request
One of the most common problems is failing to spot an SAR when it arrives. A request does not have to mention data protection law, use the words “subject access” or be sent to a particular person. It can arrive by email, letter, social media or in conversation, and it can land with anyone in the business, from a receptionist to a line manager in the middle of a difficult exit.
That is why training is important: employees need to know what a request looks like and where to send it, so that the one-month deadline can be met. Many organisations also set up a dedicated email address for SARs, which gives requests a single home and makes them easier to log and track.
What to do when you receive a subject access request
Larger organisations usually have a settled process, whereas small and medium-sized businesses often do not, and the first request tends to arrive at an inconvenient moment. A workable process covers the same ground each time.
Here’s a simple process to follow:
Log the request and the deadline
Record the date the request was received and the date the response is due, and give one person responsibility for seeing it through.
Understand the scope
If a request is unclear or very broad, you can ask the requester what information they are looking for and over what period. You are entitled to ask, but the individual is not obliged to narrow their request, so it’s important to note that clarification is a conversation rather than a condition.
Verify the requester’s identity
You need to be satisfied that the person asking is who they say they are, particularly where the request comes from an unfamiliar email address or through a third party. Ask only for what is reasonable: a former employee writing from their known personal email is in a different position from an unknown sender.
Search for the data
The search needs to be reasonable and proportionate to the request. The Data (Use and Access) Act 2025 has now confirmed this in law, building on what the courts and the ICO had already said, so you are not expected to search every corner of the business. It is worth keeping a short record of where you searched, the terms you used and why any sources were excluded, because that record is what you will rely on if the response is challenged.
Where to look for personal data
Personal data is rarely in one place. The usual sources are email accounts, collaboration platforms such as Microsoft Teams and Slack, HR and CRM systems, shared drives, internal databases and paper files. Newer technology adds to the list: recordings and images captured by devices such as smart glasses can be personal data too.
Choosing the right search tools and search terms at the outset saves a great deal of time later, and it gives you a clear record of what was searched if the response is ever challenged.
What you have to disclose and what you can withhold
Once the material has been gathered, it must be carefully reviewed before anything is sent. That review falls into three stages.
1. Identify the requester’s personal data
The right of access covers the requester’s personal data, not every document that mentions them. The first step is to set aside anything that does not amount to their personal data.
2. Protect information about other people
Information about third parties should be removed or redacted, unless they have consented to its disclosure or it is reasonable under the circumstances to disclose it without their consent. In email chains and HR records, this is often where most of the work lies.
3. Apply any exemptions
Finally, consider whether any exemptions allow you to withhold or redact information, such as legal professional privilege, management forecasting, negotiations with the requester and confidential references.
Exemptions need technical legal judgement and are applied to specific information rather than to the request as a whole. Where you rely on one, you should tell the requester, unless doing so would itself undermine the exemption.
How to send the response securely
The final step is getting the information to the requester safely. For digital transfers, password-protected files work well, with the password sent separately and ideally through a different channel. For large volumes sent by post, using a secure courier or splitting the material across several packages reduces the risk of loss.
Why subject access requests are rising
The number of SARs has risen steadily in recent years as people have become more aware of their data protection rights. Requests are also increasingly made alongside grievances, dismissals and commercial disputes, where they can be used to obtain documents earlier than formal disclosure would allow.
For any organisation that has not yet set out a process, the rise is a good reason to do so before the next request arrives.
When to get help with a subject access request
Most requests can be handled in-house with a clear process. The ones that tend to need a lawyer arrive alongside a grievance, a dismissal or a dispute, or involve years’ worth of email correspondence. Arbor Law’s privacy team can advise on scope and exemptions, review and redact the material, or run the response from start to finish.
If a request has just arrived and you would like a second opinion on how to approach it, we can help.
Frequently asked questions
What is a subject access request?
A subject access request (SAR) is a request from an individual for a copy of the personal data an organisation holds about them, together with information about how it is used. The right comes from the UK GDPR and the Data Protection Act 2018, and it applies to organisations of every size.
How long do you have to respond to a subject access request?
You have one month from receipt to respond. This can be extended by up to two further months for complex or multiple requests, provided you tell the requester within the first month, and the clock pauses while you verify their identity or seek clarification.
What should you do if you receive a subject access request?
Log the date it arrived and the date the response is due, then confirm the requester’s identity and, if needed, clarify what they are looking for. After that, search the relevant systems, review and redact the material, and send it securely before the deadline.
What is the SAR process?
The process has five stages: recognise and log the request, verify identity and clarify scope, carry out a reasonable and proportionate search, review the material by removing third-party information and applying any exemptions, and send the response securely. Keeping a record at each stage makes the response easier to defend if it is challenged.
Can you get help responding to a subject access request?
Yes. Many organisations handle routine requests themselves and bring in a data protection lawyer when a request is linked to a dispute, a grievance or a dismissal, or covers a large volume of email. Arbor Law’s privacy team can advise on scope and exemptions, review and redact the material, or manage the whole response.
