A practical guide to recognising, managing and responding to subject access requests under UK data protection law.

What is a Subject Access Request?

A Subject Access Request (SAR) is a request by a person for access to their personal information and related supplementary information held by an organisation. A valid SAR does not need to mention the UK GDPR, use a particular form or be made in writing; it may be submitted verbally, electronically or through an authorised representative.

The right of access is a fundamental data protection right. It allows people to understand whether an organisation is using their personal information, obtain a copy of that information and check how and why it is being processed.

For organisations, a SAR is not simply an administrative disclosure exercise. It is a test of information governance, records management, privacy accountability, security, legal judgement and operational coordination.

Which law governs Subject Access Requests?

For most UK organisations, the right of access is governed principally by the UK General Data Protection Regulation and the Data Protection Act 2018. The Information Commissioner’s Office (ICO) supervises and enforces these requirements.

The Data (Use and Access) Act 2025 amended aspects of the UK data protection framework. Current ICO guidance confirms, among other points, that organisations must carry out a reasonable and proportionate search and may pause the response period when clarification is reasonably required.

Identify the applicable data protection regime, including separate rules for law-enforcement or intelligence-service processing. Health, education and social-work information can also be subject to specific exemptions or restrictions; these do not automatically remove it from the UK GDPR.

How can an organisation recognise a valid SAR?

A person does not need to use the words “subject access request”. Any communication that asks for access to personal information may qualify, provided the organisation can reasonably understand that the person is exercising their right of access.

  • Requests may be made by email, letter, web form, telephone, in person or through social media.
  • A request may be addressed to any part of the organisation, not only the privacy team or DPO.
  • A third party may make a request on someone’s behalf where appropriate authority is demonstrated.
  • A request can relate to a specific item, a category of information, a period of time or all personal information held.
  • An employee grievance, complaint or litigation-related communication may also contain a valid SAR.

Frontline, HR, customer-service, complaints, legal and social-media teams should be trained to identify possible SARs and escalate them immediately. A request can be valid even when it arrives through an unexpected channel.

What information is a person entitled to receive?

A person is generally entitled to confirmation that their personal information is being processed, a copy of that personal information and supplementary information about the processing.

The personal information itself

The organisation must provide the requester’s personal information that falls within scope, subject to applicable exemptions, restrictions and the rights of other people. The right is to personal information, not automatically to every original document in which that information appears.

Supplementary information

  • The purposes for which the personal information is processed.
  • The categories of personal information concerned.
  • The recipients or categories of recipient to whom the information has been or will be disclosed.
  • The envisaged retention period, or the criteria used to determine it.
  • Information about relevant rights, including rectification, erasure, restriction and objection.
  • The right to complain to the ICO.
  • The source of the information where it was not collected from the requester.
  • Meaningful information about solely automated decision-making where applicable.
  • Information about safeguards used for relevant international transfers.

How long does an organisation have to respond?

An organisation must respond without undue delay and, in most cases, within one month. The calculation may begin when the organisation receives the request or, where legitimately required, when it receives sufficient identity evidence, authority from a representative or an applicable fee.

Can the response period be extended?

The response period may be extended by up to a further two months where necessary because the request is complex or the person has made a number of requests. The requester must be informed of the extension and the reasons for it within the initial one-month period.

Can the clock be paused for clarification?

Where clarification is reasonably required about the personal information requested, the response period can pause on the day clarification is requested and resume the day after it is received. Seeking clarification about another matter, such as the response format, does not stop the clock. Requests for clarification should be prompt, justified and accessible; they must not be an automatic delaying tactic.

Can an organisation ask for proof of identity?

An organisation may request information needed to confirm identity where it has reasonable doubts. The request must be proportionate. It should not demand more identity information than is necessary or create unnecessary barriers to the exercise of the right.

Identity checks should be requested promptly. The organisation should also verify a representative’s authority where a third party is acting for the requester.

What is a reasonable and proportionate search?

Current ICO guidance requires organisations to make reasonable and proportionate efforts to locate and retrieve the requested information. This does not require searches that would be unreasonable or disproportionate to the importance of providing access, but the organisation must be able to justify any limits placed on its search.

Relevant considerations include the circumstances of the request, the volume of information, the difficulty of retrieval and the fundamental nature of the right of access.

Potential information sources

  • Customer, patient, member or employee management systems.
  • Email accounts, shared mailboxes, messaging platforms and collaboration tools.
  • Case-management, complaint, HR, payroll and performance systems.
  • Call recordings, CCTV, access logs and security records.
  • Cloud applications, document repositories and archived records.
  • Processor-held information and relevant third-party platforms.
  • Appropriately governed business records held on authorised devices or locations.

Search decisions, custodians, systems, date ranges, search terms, exclusions and results should be documented. This evidence becomes important if the requester complains or the ICO asks the organisation to explain its approach.

How should emails and workplace messages be handled?

An email, chat message or document is not automatically disclosable in full merely because it mentions the requester. The organisation must determine which content is the requester’s personal information, whether other people’s rights are engaged and whether an exemption applies.

The correct approach is usually to identify, extract, review and disclose the requester’s personal information in context, with appropriate redaction or explanation. Excessive blanket collection followed by uncontrolled disclosure creates privacy and security risks.

What if the information relates to other people?

SAR material often contains information about colleagues, family members, patients, customers or other third parties. The organisation must balance the requester’s right of access against the rights and freedoms of those individuals.

Depending on the circumstances, the organisation may seek consent, redact identifying information, provide an intelligible extract or withhold the relevant material. The decision should consider factors such as confidentiality, the type of information, the third party’s expectations and the potential effect of disclosure.

What exemptions may apply?

The Data Protection Act 2018 contains exemptions and restrictions that may permit or require information to be withheld in defined circumstances. They should be applied narrowly, case by case and with a documented rationale.

  • Legal professional privilege.
  • Confidential references in relevant circumstances.
  • Negotiations with the requester where disclosure could prejudice those negotiations.
  • Management forecasting or planning where disclosure would prejudice the conduct of the business or activity.
  • Regulatory, crime and taxation functions in specified circumstances.
  • Certain health, education and social work information.
  • Information about other people where disclosure would be inappropriate.
  • Other specific statutory restrictions.

An exemption rarely justifies withholding an entire response. Organisations should consider whether part of the information can still be disclosed and should record the legal and factual basis for each withholding decision.

When can a SAR be refused or a fee charged?

A SAR may be refused wholly or partly where it is manifestly unfounded or excessive. The threshold is high. The organisation must assess the request on its own facts and retain clear evidence supporting its conclusion.

Manifestly unfounded

A request may be manifestly unfounded where the person clearly has no genuine intention to exercise the right or is using the request maliciously to harass or disrupt. Aggressive language, a dispute or a litigation motive does not automatically make a request unfounded.

Excessive

A request may be excessive where it is clearly or obviously unreasonable, taking account of proportionality, burden, repetition, overlap, context, available resources and the consequences of refusing access. A request is not excessive merely because it covers a large volume of information.

Fees

In most cases, a SAR must be handled free of charge. A reasonable fee reflecting administrative costs may be charged where a request is manifestly unfounded or excessive, or where the person asks for further copies of information already provided.

How should the response be delivered?

The response must be clear, intelligible and accessible. Where the request was made electronically, the information should normally be provided in a commonly used electronic format unless the requester asks otherwise.

  • Use secure transfer methods proportionate to the sensitivity and volume of the information.
  • Confirm recipient details before disclosure.
  • Protect files and communicate passwords through a separate channel where appropriate.
  • Explain codes, abbreviations, technical terms or data fields that may not be understandable.
  • Keep a complete disclosure copy and decision record.
  • Provide information about complaints and further rights where appropriate.

What is the recommended SAR workflow?

  • Recognise and log the request immediately.
  • Acknowledge receipt and identify the statutory deadline.
  • Confirm the requester’s identity and any representative authority where necessary.
  • Clarify scope only where reasonably required.
  • Issue preservation and search instructions to relevant teams and processors.
  • Carry out and document a reasonable and proportionate search.
  • Review material for relevance, duplication, exemptions and third-party information.
  • Prepare the disclosure and supplementary information.
  • Complete legal, privacy and quality-assurance review.
  • Deliver the response securely and retain a defensible audit trail.

What evidence should an organisation retain?

  • The original request and all related correspondence.
  • The date received, calculated deadline and any pause or extension.
  • Identity and authority checks.
  • The agreed or clarified scope.
  • Search instructions, custodians, systems, terms and results.
  • Decisions on proportionality, exemptions and third-party information.
  • Redaction and quality-assurance records.
  • The final response, disclosure bundle and proof of secure delivery.
  • Lessons learned, complaints and corrective actions.

A complete record demonstrates accountability and allows the organisation to defend its handling if challenged by the requester, internal audit, senior management or the ICO.

What are the most common SAR failures?

  • Failing to recognise informal or verbal requests.
  • Allowing requests to remain in local inboxes before escalation.
  • Calculating deadlines incorrectly.
  • Asking for excessive identity documentation.
  • Using clarification as an automatic delaying tactic.
  • Conducting searches without documented scope or methodology.
  • Ignoring information held by processors or business units.
  • Applying exemptions broadly without case-specific analysis.
  • Over-redacting material or disclosing third-party information in error.
  • Providing raw data without context or supplementary information.
  • Using insecure delivery methods.
  • Failing to retain evidence of decisions and searches.

How can organisations improve SAR readiness?

  • Maintain an accurate Record of Processing Activities and data map.
  • Define a documented SAR policy, procedure and responsibility matrix.
  • Train staff across all intake channels to recognise and escalate requests.
  • Maintain approved acknowledgement, clarification, extension and response templates.
  • Establish search protocols for email, collaboration tools, archives and processor systems.
  • Use consistent redaction, exemption and quality-assurance standards.
  • Monitor volumes, timeliness, complaints, recurring search difficulties and near misses.
  • Review contracts to ensure processors support rights requests promptly.
  • Test the process through periodic sampling, audits or tabletop exercises.
  • Report material risks and performance trends to senior management.

Frequently asked questions

Does a SAR need to be in writing?

No. It may be made verbally or in writing, including through email, social media or another communication channel.

Does the requester need to mention the UK GDPR?

No. The organisation should focus on the substance of the request, not the terminology used.

Can an organisation insist that its SAR form is used?

No. A form may help a person provide useful information, but it should not be treated as a condition of exercising the right.

Does a SAR entitle someone to every document mentioning them?

Not automatically. The right concerns the person’s personal information. The organisation must decide what information relates to them and provide it in an intelligible form, subject to relevant restrictions.

Can a SAR be made during an employment dispute or litigation?

Yes. A dispute or litigation motive does not invalidate a SAR. Exemptions or restrictions may apply to particular information, but the request must still be handled under the correct legal framework.

Must deleted or archived information be searched?

Potentially. The organisation should consider whether it still holds or can access the information and whether retrieval forms part of a reasonable and proportionate search. It is not normally required to recreate information that has genuinely been deleted and is no longer held.

Who is accountable for the response?

The controller remains accountable. A DPO, privacy team, legal team or specialist provider may advise and coordinate, but responsibility for lawful and timely compliance remains with the organisation.

How can IG-Smart help?

IG-Smart helps organisations create defensible, efficient and scalable subject-rights processes. Support can include:

  • SAR policy and procedure design.
  • Complex or high-risk request advisory.
  • Independent quality assurance and response review.
  • Search, scoping, redaction and exemption governance.
  • SAR backlog and remediation programmes.
  • Training for HR, Legal, Privacy, Information Governance and frontline teams.
  • Privacy governance and maturity assessments.
  • Fractional and outsourced DPO support.
  • Executive reporting, metrics and process improvement.

Sources and review note

This guide reflects ICO subject access guidance available on 4 August 2026, including updates made following the Data (Use and Access) Act 2025. Organisations should obtain advice on their particular facts and monitor future ICO updates.

ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/

ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/

ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/

ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/when-can-we-consider-a-sar-to-be-manifestly-unfounded-or-excessive/