Structured, defensible DSAR management, without disrupting operations.
You have one calendar month to answer a subject access request under UK GDPR, and the clock starts the day it arrives. Our DSAR service finds the data, redacts third-party information correctly, and keeps your response on track for the deadline.
What Is a Data Subject Access Request (DSAR)?
A fundamental data subject right under UK law that demands rapid, methodical compliance.
A data subject access request is a person's legal right, under UK GDPR Article 15, to get a copy of the personal data your organisation holds about them. Customers, employees, former staff, and job applicants can all make one, by email, letter, phone, web form, or a message to any member of staff.
The Statutory Deadline Is Tight:
-
01
One calendar month: Calculated from the day you receive the request.
-
02
Up to two further months: If the request is complex or the person has made several requests, as long as you inform them within the first month and explain why.
-
03
A pause in the clock: While you wait for proof of identity or clarification you genuinely need to locate the data.
Your response has to cover more than the data itself. It must explain why you hold it, who you share it with, and how long you keep it. Subject access is one of the most common reasons people complain to the ICO, and a late or incomplete response can lead directly to regulatory enforcement.
Why DSAR Handling Is Harder Than It Looks
A DSAR sounds simple: find the data and send it over. In practice, it involves a chain of legal judgements, all against the clock:
- Verifying identity without collecting more data than you need
- Scoping a reasonable and proportionate search across email, databases, and third-party processors
- Redacting other people's information and applying exemptions correctly
How KEWDATA Solves the Hard Parts of a DSAR
Three problems trip up most organisations handling a subject access request: finding everything they hold, redacting third-party data correctly, and responding within the legal time limit. Our SAR handling service tackles all three, and keeps a clear record of how we did it.
Finding Every Record
Personal data sits in CRMs, mailboxes, HR files, finance systems, shared drives, chat tools, and backups. We map where the requester's data lives and coordinate a reasonable, proportionate search across your internal systems and third-party cloud processors.
Redacting Third-Party Data Correctly
Disclose too much and you breach someone else's privacy. Redact too much and you invite a complaint. We review records line by line, remove third-party information where the law allows, and apply exemptions such as legal privilege only where they fit.
Employee: John Doe confirmed discussion with regarding as protected by legal privilege.
Responding Within the Legal Time Limit
We fix the statutory deadline from the day your organisation received the request, track any pause or complex extension rigorously, and keep the work moving so your response is ready before the due date.
ICO-Ready Records
We log the intake, search, redaction, and response stages in a formal decision register, so you can demonstrate accountability to the Information Commissioner's Office if they ever enquire.
When Do Organisations Seek Our Support?
We support businesses facing high request volumes, disputed requests, or the need for a repeatable internal process.
High-Volume Request Backlogs
Handling seasonal or growth-driven spikes in data access requests without pulling engineering, HR, and support staff away from their core responsibilities.
Complex Employee Disputes
Handling DSARs from current or former employees involved in grievances, tribunals, or litigation, where internal emails and chat threads need careful review and redaction.
Ongoing Monthly Retainer Support
Handing your DSAR response process to KEWDATA privacy practitioners on an ongoing basis, with guaranteed service levels and agreed turnaround times for each request.
Process Design & Staff Training
Building response templates, writing internal playbooks, and training customer-facing teams to recognise and log requests correctly across every intake channel.
Disputed & ICO-Referred Complaints
Responding when a requester complains to the ICO: reviewing the original disclosure, resolving scope disputes, and formally explaining redactions to the regulator.
Consumer Product Compliance
Managing high-velocity individual rights requests for consumer apps, FinTech platforms, and e-commerce brands with extensive customer databases.
The Scope of a KEWDATA DSAR Response
Our DSAR management process maps search areas, handles identity checks, and builds clean disclosure files.
Intake & Scoping
- Assessment of request validity and scope across all intake channels.
- Logging the statutory one-month deadline from the exact date of receipt.
- Advising when clarification is reasonably required, and recording any pause in the deadline.
Identity Verification Records
- Proportionate verification checks based on the sensitivity and nature of the data.
- Recording verification steps in line with ICO right of access guidance.
- Avoiding unlawful over-collection of personal data during ID checks.
Multi-System Search Map
- Mapping corporate databases, server files, mail archives, and local user directories.
- Coordinating structured searches across third-party cloud platforms and backups.
- Recording search parameters to prove the exercise was reasonable and proportionate.
Exemption & Redaction
- Redacting third-party personal identifiers to prevent secondary privacy breaches.
- Applying statutory exemptions (legal professional privilege, management forecasts, confidential references).
- Formally logging the specific legal reasoning behind every withheld document.
Compliant Response Pack & Audit Evidence
- Preparing structured personal data disclosure files in an accessible format.
- Assembling mandatory Article 15 supplementary information and complaints procedure notes.
- Transmitting responses securely through encrypted transfer channels.
- Storing the full decision log and search history ready for ICO inspection.
Standard statutory response window (1 calendar month). Clock started on receipt.
Our Handling Methodology: Step by Step
A structured process that keeps each request moving towards the deadline, with a clear record at every phase.
Intake
We assess whether the request is valid, identify the data subject, and confirm the scope. We log the date your organisation received it, because that's when the one-month clock started.
Identity Check
Where there's real doubt about who's asking, we run proportionate identity checks and record the verification method and result without collecting excessive data.
Data Location
We map the systems, databases, email archives, third-party processors, and informal communication channels likely to hold the requester's data.
Collection and Review
We coordinate collection across teams, redact third-party information, and apply statutory exemptions against legal requirements, not just internal habit.
Response Pack
We prepare the structured personal data disclosure, the Article 15 supplementary information pack, and an executive cover letter.
Quality Check and Release
We check the pack for completeness and accuracy, release it through a secure channel, and preserve the complete handling log.
What You Receive at the End of the Handling Process
Our DSAR response service gives the requester what the law entitles them to, while protecting other people's data and your legitimate business information. Your organisation remains the controller and approves the final response.
| DELIVERABLE ASSET | TARGET AUDIENCE | COMPLIANCE VALUE |
|---|---|---|
|
Compliant Response Pack
|
REQUESTING SUBJECT | The disclosed data and the Article 15 supplementary information in a clean, accessible format. |
|
DSAR Exemption Log
|
DPO & LEGAL COUNSEL | The statutory legal basis for each redaction and withheld document, protecting you from privacy breach risks. |
|
Handling Audit Trail Pack
|
ICO CASE OFFICERS | Contemporaneous records of receipt, pauses, extensions, search parameters, and sign-offs ready for regulator scrutiny. |
Tom S.
Medical Practice
"Improved control over sensitive medical data"
"Practical guidance on access controls and data protection. Helped define structured access policies and introduced tokenisation for patient identifiers used in analytics."
Sarah S.
Retail, Enterprise
"Reliable partner for telecom data protection"
"Quickly understood telecom data complexity; helped classify sensitive datasets and apply protection measures for subscriber, usage, and billing data."
Pauliina H.
Entertainment, Enterprise
"Effective support for securing customer data"
"Identified where sensitive data lived and applied tokenization and anonymization strategies in a complex telecom environment."
Jordan R.
Computer Networking
"Practical approach to safeguarding e commerce"
"Helped protect PII, payment data, and order histories with tokenization and anonymization; advised on GDPR compliance for international operations."
Charmaine S.
Int. Trade & Development
"Systematic Approach Enhances Data Security"
"Methodical approach through discovery, planning, and implementation; implemented Microsoft Purview for a scalable compliance framework."
Kateryna H.
IT and Services
"Practical approach to protecting sensitive Data"
"Structured data discovery and classification combining technical analysis with finance data privacy expertise; strong masking and tokenization policies."
Snow D.
Market Research
"Practical expertise for telecom information"
"Introduced tokenization and controlled access strategies for subscriber data while still supporting analytics and reporting."
Laura H.
Hospital & Health Care
"Valuable expertise in healthcare protection"
"Strong expertise in healthcare data security; introduced anonymization techniques for safely using patient data in research and reporting."
Frequently Asked Questions
Standard questions about individual rights requests and KEWDATA response services.
Facing a complex DSAR, employee dispute, or high backlog volumes?
Tell us what you've received and when it arrived. We'll map out the deadline and what needs doing first. Speak with a KEWDATA specialist today.
Get SAR Support Before Your Deadline Expires