How to Respond to a Subject Access Request: UK Guide

A subject access request can arrive as a two-line email, a social media comment or a solicitor’s letter. However it lands, the law sets out what happens next. Here’s how to respond to a subject access request in six steps, based on the ICO’s right of access guidance and UK GDPR. 

What is a subject access request? 

A subject access request (SAR, sometimes called a DSAR) is a person asking for the personal information an organisation holds about them. Under Article 15 of UK GDPR, they’re entitled to confirmation that you use their information, a copy of it, and details of how you use it. Anyone can ask. They don’t need a reason, a form or any special wording. 

Step 1: Recognise the request 

If someone asks for their own personal information, it’s a request. It doesn’t have to mention the law. It can come by email, phone, letter, chat or social media, to anyone in your organisation, and it’s often tucked inside a complaint or a grievance. 

Make sure staff know what a request sounds like and who to pass it to. You can offer a form, but you can’t insist on it. If someone is asking for another person, such as a solicitor for a client, check they have the authority to act. 

Step 2: Log it, check ID and clarify 

Log it. Record the date, the person and what they asked for. That date starts the clock. 

Know the SAR time limit. You have one month. A request received on 3 September is due by 3 October. If the deadline falls on a weekend or public holiday, the ICO says you have until the end of the next working day. 

Check ID only if you need to. If you already know the person, you may not need any. If you do, ask only for what’s reasonable. Under Article 12A of UK GDPR, the month starts once you have it. 

Clarify only when it’s genuinely needed. If you hold a lot of information and the request is unclear, you can ask what they’re looking for, and the clock pauses while you wait. You can’t use this to make someone narrow their request. 

For complex requests, you can extend by up to two more months. Tell the person within the first month and explain why. In most cases, you can’t charge a fee. 

Step 3: Search for the information 

You must carry out a reasonable and proportionate search. That’s now written into UK GDPR by the Data (Use and Access) Act 2025. It means searching properly, not just where it’s easy. 

List every place the person’s information is likely to be: email (including deleted items), HR and customer systems, shared drives, chat tools, paper files, CCTV and backups. The ICO is clear there’s no technology exemption, and information held for you by a processor counts too. 

Never change or delete information because a request has arrived. Doing that to prevent disclosure is a criminal offence under section 173 of the Data Protection Act 2018. Keep a note of where you searched and what you found. 

Step 4: Review and redact 

The right is to personal information, not whole documents. Most of the review is about other people named in the records. The ICO’s test is simple: can you share the requester’s information without revealing the other person? If not, have they consented? If not, is it still reasonable to share? 

Then check for exemptions, such as legal professional privilege or confidential references. Apply them item by item, never as a blanket. Record every decision and why, and make sure redactions are permanent. A black box drawn over a PDF can often be removed. 

Step 5: Respond 

Send a copy of the person’s information, plus details of why you use it, who you share it with, how long you keep it, and their rights, including the right to complain to you and to the ICO. Much of this may already be in your privacy notice. 

Use plain language and explain any codes. If the request came electronically, reply in a commonly used electronic format. Send it securely. If you’re refusing any part, say why within the month and tell them how to complain to the ICO. 

Step 6: After you respond 

Keep a record of the whole process, including redacted and unredacted copies. Since 19 June 2026, you also need a process for data protection complaints. The ICO’s complaints guidance says you must acknowledge a complaint within 30 days and tell the person the outcome. 

Then look at what slowed you down. Tidy records and regular deletion make the next request quicker. 

New to the process?  

Start with our step-by-step guide to handling a subject access request. For short, insightful updates each week, follow DSAR.ai on LinkedIn. And if there’s a tricky request on your desk, talk to our team.