Someone has asked for a copy of their personal data, and your response deadline started the day you received the request. Get it wrong, and you risk a complaint to the ICO. Get it right, and it becomes a routine task your team can repeat.

This guide walks through the full process: what counts as a valid request, how long you actually have, and the five steps from verifying who’s asking to filing the record afterwards. It also covers the mistakes that land businesses in front of the regulator.

What Is a Data Subject Access Request?

A subject access request, also called a SAR or DSAR, is someone asking for a copy of the personal data you hold about them. It comes from Article 15 of the UK GDPR, and it’s one of the strongest rights individuals have over their own information.

A few things catch businesses out:

• Anyone can make one: Customers, employees, former employees, job applicants, suppliers, and members of the public all have this right.
• There’s no set format: A SAR can arrive by email, letter, phone call, web form, social media message, or in conversation. Someone doesn’t have to use the words “subject access request” for it to count.
• It can go to anyone in your organisation: A request sent to a sales rep or posted on your Facebook page is still valid. Your staff needs to recognise one when it lands.
• You usually can’t charge: A fee is only allowed if the request is manifestly unfounded or excessive, or if someone asks for further copies of the same information.

What the person is entitled to receive:

• Confirmation that you’re processing their personal data
• A copy of that personal data
• Supplementary information: why you’re processing it, who you share it with, how long you’ll keep it, where you got it from, and their other rights

That last part matters. A SAR response isn’t just a data dump. It has to explain what you’re doing with the information and why.

The Time Limit and When You Can Extend It

The deadline is one calendar month, not 30 days. It starts the day you receive the request. So a request received on 3 March is due by 3 April. If there’s no matching date in the following month, you get until the last day of that month.

Extending to three months

You can extend by a further two months, giving three months in total, when the request is complex or when someone has made several requests. Complexity is judged case by case. A large volume of records on its own doesn’t automatically make a request complex.

If you extend, you have to tell the person within the first month and explain why. Extending quietly, or telling them on day 29 without a reason, won’t hold up.

Stopping the clock

Two situations pause the deadline:

• Asking for clarification: If you hold a lot of information about someone, or the request is vague, you can ask them to narrow it down. As the ICO’s guide to subject access explains, the clock pauses on the day you ask and restarts the day after they reply. You can only do this where clarification is reasonably required, and you can’t force anyone to narrow their request.
• Verifying identity: Where you genuinely need proof of who’s asking, the time limit runs from when you receive that proof.

The Data (Use and Access) Act 2025 put both of these on a statutory footing and confirmed that your search has to be reasonable and proportionate rather than exhaustive.

Whatever you do, record it. If a complaint reaches the ICO, you need to show when the pause started, what you asked for, and when the clock restarted.

Step 1: Verify the Identity of the Requestor

Sending someone else’s personal data to the wrong person is a data breach. Identity verification protects you and the person whose data it is.

Do this:

• Ask for ID only where you have real doubt about who’s asking
• Use what you already hold, such as confirming details from their account
• Ask quickly, within a few days of the request, not three weeks in
• Accept proportionate evidence, such as a photo of a driving licence or a reply from a verified email address

Don’t do this:

• Ask everyone for ID as standard
• Demand more documents than you need
• Insist on certified copies or originals by post when a scan would do
• Use verification as a delaying tactic

If someone emails from an address already on your system, you probably don’t need anything further.

Requests made by someone else. Solicitors, family members, and other representatives can make a SAR on someone’s behalf. Check they have authority, usually through written consent or a power of attorney, and satisfy yourself that releasing the data to that person is appropriate.

Step 2: Identify All Data Held on the Individual

This is where most of the work sits. Personal data spreads further through a business than people expect.

Where to look:

• CRM and customer databases: account records, order history, support tickets, call notes
• Email: mailboxes across the business, including messages that mention the person rather than being addressed to them
• HR systems: contracts, appraisals, disciplinary files, absence records, recruitment notes
• Finance systems: invoices, payment records, expense claims
• Cloud storage and shared drives: spreadsheets, reports, project documents
• Collaboration tools: Slack, Teams, and similar platforms
• CCTV and access logs, where the person is identifiable
• Backups and archives

Structured versus unstructured data. Pulling a customer record out of a CRM is straightforward. Finding every mention of someone across years of email threads and shared documents is much harder. Unstructured data is where teams lose days, so scope the search early and use whatever search tools your systems offer.

On backups. You need to search backups where it’s reasonable and proportionate to do so, but you’re not expected to restore every historical backup to find one record. Document what you searched and what you decided to leave out, along with your reasoning.

Step 3: Apply Exemptions

Not everything you find has to go out. The UK GDPR and Schedule 2 of the Data Protection Act 2018 set out exemptions, and each one applies to specific material rather than the whole response.

• Third-party data: Article 15(4) says the right to a copy must not adversely affect other people’s rights. Where a document names someone else, you can either redact their details, or disclose if that person consents or if disclosure is reasonable without consent. Weigh up any duty of confidentiality you owe them, what they’d expect, and whether they’ve objected.
• Legal professional privilege: Legal advice and material prepared for litigation stays exempt.
• Management forecasts: Business planning material, such as restructuring proposals or promotion plans, can be withheld where disclosure would prejudice the business activity in question.
• Confidential references: References given in confidence for employment, education, training, or appointment to office are exempt, whether your organisation gave or received them.
• Negotiations: Records of negotiations with the requester can be withheld where disclosure would prejudice those negotiations.

Apply exemptions narrowly. Redacting a name from a paragraph is fine. Withholding a whole document because one line is privileged is the kind of decision the ICO will question.

Step 4: Compile and Send the Response

Format. If the request arrived electronically, respond electronically unless the person asks otherwise. Common options are a PDF pack, a secure portal or file transfer link, or a physical copy for someone without reliable email access. Whatever you pick, send it securely. Emailing an unencrypted file of HR records to the wrong address turns a SAR into a breach.

What your cover letter needs to include:

• Confirmation that you’re processing their personal data
• The purposes you’re processing it for
• The categories of personal data involved
• Who you’ve shared it with or will share it with, including any overseas recipients
• How long you’ll keep it, or how you decide that
• Where the data came from, if you didn’t get it from them
• Whether there’s any automated decision-making or profiling
• Their rights to rectification, erasure, restriction, and objection
• Their right to complain to the ICO
• Details of your own complaints procedure

That last point changed recently. From 19 June 2026, the Data (Use and Access) Act requires controllers to run a formal complaints procedure for data subjects, so your response templates need to point people to it alongside the ICO.

If you’ve redacted anything or applied an exemption, say so and explain why in general terms. Silent redactions look like something’s being hidden.

Step 5: Document the Request and Response

Accountability under Article 5(2) means being able to show how you handled the request, not just that you handled it.

Keep a record of:

• When the request arrived and how
• What the person asked for
• Identity verification steps and when you completed them
• Any clarification you sought, and when the clock paused and restarted
• Any extension, the reason, and the date you told them
• Which systems you searched and how
• Exemptions applied and the reasoning behind each
• What you sent, when, and how
• Any follow-up correspondence

How long to keep it. No fixed retention period exists in law for SAR records. Most organisations align it with their wider retention schedule and the time limits for bringing a claim, which usually means keeping the correspondence and decision log for a few years. Whatever you settle on, write it into your retention policy and apply it consistently. Keeping copies of the disclosed data forever creates its own problem.

Common SAR Mistakes That Lead to ICO Complaints

1. Missing the deadline without explanation: Late responses are the most common cause of complaints. If you need an extension, ask for it within the first month and give a reason.
2. Treating identity checks as a delay tactic: Asking for ID you don’t need, or asking three weeks in, reads as obstruction.
3. Over-redacting: Blacking out large sections without explaining why invites a complaint and rarely survives scrutiny.
4. Searching too narrowly: Checking the CRM and stopping there misses email, shared drives, and HR files. Requesters often know what you hold.
5. Sending data without the supplementary information: A pile of records with no explanation of purposes, recipients, or retention isn’t a compliant response.

Need Help Handling a SAR?

A single complex request can absorb a week of your team’s time, and the deadline doesn’t move for holidays or busy periods. KEWDATA supports UK organisations through the whole process, from scoping a difficult request to applying exemptions and preparing the response pack.

See our DSAR support service for how that works.