# A subject access request arrives: what should you do?

Recognise the request, work out the deadline and organise a clear, secure response.

The Assurance Desk. Published 9 October 2026. Last checked 9 October 2026.

Part of the guide [UK GDPR’s seven principles, in plain English](https://theassurancedesk.com/guides/uk-gdpr-seven-principles.md).

**The short answer.** When a subject access request arrives, record it and start organising the response. Under UK GDPR, respond without undue delay and normally within one month. Check identity only where needed, find the relevant personal data and provide it with the required supporting information ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/15), [ICO, How do we recognise a subject access request (SAR)?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-recognise-a-subject-access-request-sar/), [ICO, What should we consider when responding to a request?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/) and [ICO, How do we find and retrieve the relevant information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/), checked 9 October 2026).

## How do you recognise a subject access request?

A request can arrive by email, in conversation or through social media. It can go to any part of the organisation. The person does not need to use the words “subject access request” or name a law ([ICO, How do we recognise a subject access request (SAR)?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-recognise-a-subject-access-request-sar/), checked 9 October 2026).

For example, “Please send me the personal information you hold about me” could be a request. This is fictional wording to help staff recognise the task ([ICO, How do we recognise a subject access request (SAR)?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-recognise-a-subject-access-request-sar/), checked 9 October 2026).

Record what was asked for, when it arrived and who is handling it. The ICO recommends recording requests, including those made verbally. Make sure the person responsible has the details promptly ([ICO, How do we recognise a subject access request (SAR)?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-recognise-a-subject-access-request-sar/), checked 9 October 2026).

## What is the deadline for responding?

The normal deadline is one calendar month. Count to the same date in the next month. If there is no matching date, use that month’s last day. If the deadline falls on a weekend or public holiday, it moves to the next working day ([ICO, What should we consider when responding to a request?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/), checked 9 October 2026).

Identity checks, clarification and an extension are different things. Record why any of them is needed. Extra time should not become the default response ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/12), [ICO, What should we consider when responding to a request?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/12A.), checked 9 October 2026).

**What can affect the response period?**

| Situation | What changes |
| --- | --- |
| Ordinary request | Respond without undue delay and within one month. |
| Necessary identity information is missing | The relevant start takes account of receiving that required information. Do not ask for formal ID automatically. |
| Clarification is reasonably needed to identify the information or activity | The clock pauses when you ask and resumes the day after the clarification arrives. Do not force the person to narrow the request. |
| Complexity or the person’s number of requests makes more time necessary | Up to two further months may be allowed. Explain the extension and its reason before the initial month ends. |

Source: legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/12 (checked 9 October 2026); ICO, What should we consider when responding to a request?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/ (checked 9 October 2026); legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/12A. (checked 9 October 2026)

**Keep the request moving**

1. Record: Capture the request and calculate the response date.
2. Find: Carry out reasonable and proportionate searches.
3. Review: Check the data, other people’s information and supporting details.
4. Send: Explain the response clearly and check the recipient before sending.

Track the deadline throughout. Search and review do not create an automatic extension.

Source: ICO, How do we recognise a subject access request (SAR)?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-recognise-a-subject-access-request-sar/ (checked 9 October 2026); ICO, What should we consider when responding to a request?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/ (checked 9 October 2026); ICO, How do we find and retrieve the relevant information?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/ (checked 9 October 2026); ICO, How can we supply information to the requester?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-can-we-supply-information-to-the-requester/ (checked 9 October 2026); ICO, When can an exemption apply to information about other people in a SAR?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/when-can-an-exemption-apply-to-information-about-other-people-in-a-sar/ (checked 9 October 2026)

## When should you ask for ID or clarification?

Only ask for extra identity information where there are reasonable doubts about who is making the request. Ask for what is necessary. Existing checks may be enough, so a passport should not be a routine first demand ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/12) and [ICO, What should we consider when responding to a request?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/), checked 9 October 2026).

Ask for clarification only where it is reasonably needed to identify the requested information or activity. You cannot require someone to narrow the request. Supporting information that can reasonably be supplied without clarification remains due within the original month ([ICO, What should we consider when responding to a request?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/), checked 9 October 2026).

A large amount of information does not, by itself, make a request complex. Check the actual reason for an extension and explain it in time ([ICO, What should we consider when responding to a request?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/12A.), checked 9 October 2026).

## Where should you search for the information?

Carry out a reasonable and proportionate search. If you decide a particular search would be disproportionate, record why and continue the other reasonable searches. Do not treat that decision as a reason to stop the whole response ([ICO, How do we find and retrieve the relevant information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/), checked 9 October 2026).

Consider the relevant systems and people. Information held by a processor for you, or work information on a personal device, can be within scope. Do not deliberately change requested information to prevent its disclosure ([ICO, How do we find and retrieve the relevant information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/), checked 9 October 2026).

Being copied into an email does not automatically make every word of that email the person’s personal data. Check the information itself and keep enough context for the answer to make sense ([ICO, How do we find and retrieve the relevant information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/) and [ICO, How can we supply information to the requester?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-can-we-supply-information-to-the-requester/), checked 9 October 2026).

## What if the records mention someone else?

Assess the other person’s information before sharing it. Consider whether they consent, or whether disclosure without consent would be reasonable. The presence of another name is not a reason to reject the whole request automatically ([ICO, When can an exemption apply to information about other people in a SAR?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/when-can-an-exemption-apply-to-information-about-other-people-in-a-sar/), checked 9 October 2026).

Keep a record of what you disclosed or withheld and why. Where material is removed, check that the remaining response still makes sense ([ICO, How can we supply information to the requester?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-can-we-supply-information-to-the-requester/) and [ICO, When can an exemption apply to information about other people in a SAR?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/when-can-an-exemption-apply-to-information-about-other-people-in-a-sar/), checked 9 October 2026).

## What should the final response contain?

Confirm whether you process the person’s data and provide the relevant copy. Supporting information includes the purposes, kinds of data, recipients and retention period or criteria. Explain the relevant rights and routes to complain, including to your organisation and the ICO ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/15), checked 9 October 2026).

Where relevant, also give available information about where data came from, automated decisions and the safeguards for overseas transfers. The exact content needs to fit the data and its use ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/15), checked 9 October 2026).

The ICO stresses that the response needs enough context to be understandable. A pile of unexplained files may leave the person unable to make sense of the information ([ICO, How can we supply information to the requester?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-can-we-supply-information-to-the-requester/), checked 9 October 2026).

Check the recipient’s address before sending. For an electronic request, the normal response is in a commonly used electronic format unless the person asks otherwise. Encryption with the access code sent separately is one possible way to protect the response ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/15) and [ICO, How can we supply information to the requester?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-can-we-supply-information-to-the-requester/), checked 9 October 2026).

> "you should provide enough contextual information to ensure that the response is concise, intelligible and easy for the person to understand."
> ICO, Subject access guidance
> ICO, How can we supply information to the requester?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-can-we-supply-information-to-the-requester/ (checked 9 October 2026)

## What to do

1. Record the request and allocate responsibility ([ICO, How do we recognise a subject access request (SAR)?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-recognise-a-subject-access-request-sar/), checked 9 October 2026).
2. Calculate the deadline and record any justified change ([ICO, What should we consider when responding to a request?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/12A.), checked 9 October 2026).
3. Search reasonably and proportionately, including relevant information held for you ([ICO, How do we find and retrieve the relevant information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/), checked 9 October 2026).
4. Review other people’s information and record the decisions ([ICO, When can an exemption apply to information about other people in a SAR?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/when-can-an-exemption-apply-to-information-about-other-people-in-a-sar/), checked 9 October 2026).
5. Supply the data and supporting information clearly, then check the recipient ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/15) and [ICO, How can we supply information to the requester?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-can-we-supply-information-to-the-requester/), checked 9 October 2026).

## Common questions

### Can we charge for a subject access request?

Usually it is free. A reasonable administrative fee may be allowed for a manifestly unfounded or excessive request, or for further copies. Where a fee is permitted, receiving it can affect when the response period starts ([ICO, What should we consider when responding to a request?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/12A.), checked 9 October 2026).

### Must the person use our form?

A request can be verbal or written and does not need legal wording. A form may help collect details, but the organisation still needs to recognise requests received in other ways ([ICO, How do we recognise a subject access request (SAR)?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-recognise-a-subject-access-request-sar/), checked 9 October 2026).

## Where next

- [What must your UK privacy notice say?](https://theassurancedesk.com/guides/what-your-privacy-notice-must-say.md)
- [ICO has written to you: what to do in the first week](https://theassurancedesk.com/guides/ico-has-written-to-you.md)
- [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md)
- [Is UK GDPR changing in 2026?](https://theassurancedesk.com/guides/uk-gdpr-changes-data-use-and-access-act.md)
- [Law firm or consultancy for GDPR advice?](https://theassurancedesk.com/guides/law-firm-or-consultancy-for-gdpr-advice.md)

## Sources

- legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/15 (checked 9 October 2026)
- ICO, How do we recognise a subject access request (SAR)?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-recognise-a-subject-access-request-sar/ (checked 9 October 2026)
- ICO, What should we consider when responding to a request?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/ (checked 9 October 2026)
- ICO, How do we find and retrieve the relevant information?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/ (checked 9 October 2026)
- legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/12 (checked 9 October 2026)
- legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/12A. (checked 9 October 2026)
- ICO, How can we supply information to the requester?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-can-we-supply-information-to-the-requester/ (checked 9 October 2026)
- ICO, When can an exemption apply to information about other people in a SAR?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/when-can-an-exemption-apply-to-information-about-other-people-in-a-sar/ (checked 9 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.