A subject access request arrives: what should you do?

Part of the guide UK GDPR’s seven principles, in plain English

How do you recognise a subject access request?

A request can arrive by email, in conversation or through social media. It can go to any part of the organisation. The person does not need to use the words “subject access request” or name a law.

For example, “Please send me the personal information you hold about me” could be a request. This is fictional wording to help staff recognise the task.

Record what was asked for, when it arrived and who is handling it. The ICO recommends recording requests, including those made verbally. Make sure the person responsible has the details promptly.

What is the deadline for responding?

The normal deadline is one calendar month. Count to the same date in the next month. If there is no matching date, use that month’s last day. If the deadline falls on a weekend or public holiday, it moves to the next working day.

Identity checks, clarification and an extension are different things. Record why any of them is needed. Extra time should not become the default response.

What can affect the response period?
Situation	What changes
Ordinary request	Respond without undue delay and within one month.
Necessary identity information is missing	The relevant start takes account of receiving that required information. Do not ask for formal ID automatically.
Clarification is reasonably needed to identify the information or activity	The clock pauses when you ask and resumes the day after the clarification arrives. Do not force the person to narrow the request.
Complexity or the person’s number of requests makes more time necessary	Up to two further months may be allowed. Explain the extension and its reason before the initial month ends.

Keep the request moving

Record Capture the request and calculate the response date.
Find Carry out reasonable and proportionate searches.
Review Check the data, other people’s information and supporting details.
Send Explain the response clearly and check the recipient before sending.

Track the deadline throughout. Search and review do not create an automatic extension.

When should you ask for ID or clarification?

Only ask for extra identity information where there are reasonable doubts about who is making the request. Ask for what is necessary. Existing checks may be enough, so a passport should not be a routine first demand.

Ask for clarification only where it is reasonably needed to identify the requested information or activity. You cannot require someone to narrow the request. Supporting information that can reasonably be supplied without clarification remains due within the original month.

A large amount of information does not, by itself, make a request complex. Check the actual reason for an extension and explain it in time.

Where should you search for the information?

Carry out a reasonable and proportionate search. If you decide a particular search would be disproportionate, record why and continue the other reasonable searches. Do not treat that decision as a reason to stop the whole response.

Consider the relevant systems and people. Information held by a processor for you, or work information on a personal device, can be within scope. Do not deliberately change requested information to prevent its disclosure.

Being copied into an email does not automatically make every word of that email the person’s personal data. Check the information itself and keep enough context for the answer to make sense.

What if the records mention someone else?

Assess the other person’s information before sharing it. Consider whether they consent, or whether disclosure without consent would be reasonable. The presence of another name is not a reason to reject the whole request automatically.

Keep a record of what you disclosed or withheld and why. Where material is removed, check that the remaining response still makes sense.

What should the final response contain?

Confirm whether you process the person’s data and provide the relevant copy. Supporting information includes the purposes, kinds of data, recipients and retention period or criteria. Explain the relevant rights and routes to complain, including to your organisation and the ICO.

Where relevant, also give available information about where data came from, automated decisions and the safeguards for overseas transfers. The exact content needs to fit the data and its use.

The ICO stresses that the response needs enough context to be understandable. A pile of unexplained files may leave the person unable to make sense of the information.

Check the recipient’s address before sending. For an electronic request, the normal response is in a commonly used electronic format unless the person asks otherwise. Encryption with the access code sent separately is one possible way to protect the response.

you should provide enough contextual information to ensure that the response is concise, intelligible and easy for the person to understand.

What to do

Record the request and allocate responsibility.
Calculate the deadline and record any justified change.
Search reasonably and proportionately, including relevant information held for you.
Review other people’s information and record the decisions.
Supply the data and supporting information clearly, then check the recipient.

Common questions

Can we charge for a subject access request?

Usually it is free. A reasonable administrative fee may be allowed for a manifestly unfounded or excessive request, or for further copies. Where a fee is permitted, receiving it can affect when the response period starts.

Must the person use our form?

A request can be verbal or written and does not need legal wording. A form may help collect details, but the organisation still needs to recognise requests received in other ways.

Where next

Sources

This is an independent editorial guide, not legal advice.