Subject Access Requests: How to Respond as a Small Business
Anyone whose personal data you hold can ask for a copy of it, by email, letter, phone or even a comment to a member of staff. For UK businesses, that is a subject access request, and you usually have one month to respond. This guide walks you through each step, from spotting a request to sending a complete, properly redacted reply.
Key takeaways
- Respond within one month of receipt. You can extend by up to two more months if the request is complex or numerous, but you must tell the person within the first month.
- Requests can be made verbally or in writing, to anyone in the business, and do not need special wording.
- Responding is usually free. You can charge a reasonable fee or refuse only if a request is manifestly unfounded or excessive.
- Verify identity, search reasonably and proportionately, and redact other people's data.
- Send a copy of the data plus supplementary information: purposes, recipients, retention, source and rights.
The right of access is one of the most used rights under UK GDPR. Customers use it to find out what you know about them. Former employees often use it during a dispute, sometimes as a way to gather documents. Either way, the law treats the request the same: you must respond fully, on time and without asking why the person wants the data.
For a small business without a data protection officer, the first request can feel overwhelming. The good news is that a clear process makes most requests manageable in a few hours. The Data (Use and Access) Act 2025 has also clarified a couple of points that help, which we cover below.
This guide is general information, not legal advice. It is written for UK businesses; EU GDPR has very similar rules, but check with your national supervisory authority. For tricky requests, especially ones linked to an employment dispute or legal claim, check the ICO guidance or speak to a qualified adviser.
Recognizing a subject access request
A request does not have to mention "GDPR", "subject access" or any particular law. It just has to be a request from an individual for their own personal data. Examples include:
- An email saying "Please send me everything you hold about me"
- A customer asking a shop assistant what information the business keeps on them
- A former employee asking for copies of emails that mention them
- A social media message asking for their account history
- A solicitor writing on behalf of a client (with the client's authority)
Because a request can arrive anywhere, everyone in the business needs to know two things: what a request looks like and who to pass it to straight away. The one-month clock starts when anyone in the business receives the request, not when it reaches the right person.
Common mistake
Insisting the person fills in your own SAR form before you start. You can offer a form to make things easier, but you cannot refuse a valid request because it was made another way, and the clock still runs.
The deadline and when it can change
The month runs from the day you receive the request to the corresponding calendar date in the next month. If there is no corresponding date, or it falls on a weekend or bank holiday, the ICO's guidance explains how to adjust. In practice, aim to finish well before the deadline.
The deadline can change in three situations:
- Verifying identity. If you have reasonable doubts about who is asking, you can ask for proof. The clock typically starts once you receive it.
- Seeking clarification. If you hold a large amount of data about the person and genuinely need them to say what they are looking for, you can ask. The Data (Use and Access) Act 2025 makes clear the clock can pause while you wait. Check the ICO guidance on what is in force.
- Extending. For complex or numerous requests you can extend by up to two more months, but you must tell the person within the first month and explain why.
Step by step: handling a request
- Log it. Record the date received, the person's name, how the request arrived and the deadline. Acknowledge receipt so the person knows you are dealing with it.
- Verify identity proportionately. If the request comes from a known customer's registered email address, you may not need more. If there is doubt, ask for reasonable proof. Do not demand more than you need, and do not keep copies of ID longer than necessary.
- Clarify if needed. Ask what the person is looking for only if you genuinely need it to find the data. You cannot use clarification to delay or narrow a simple request.
- Search. Look in every place where their data is likely to be: email, CRM, accounting and payroll systems, shared drives, paper files, chat apps, CCTV, phone systems and suppliers that process data for you. Searches need to be reasonable and proportionate.
- Collect and review. Gather the results in one place. Remove duplicates and anything that is not the requester's personal data.
- Apply exemptions and redact. Remove other people's personal data unless they consent or it is reasonable to disclose it, and consider whether any exemption applies.
- Prepare the response. Provide a copy of the data and the supplementary information, in a commonly used electronic format if the request was made electronically.
- Send securely and record. Use a secure method, such as an encrypted file with the password sent separately. Keep a record of what you sent and when.
Pro tip
Keep a simple data map: a list of every system and folder that holds personal data and who manages it. It turns step 4 from a scramble into a checklist, and it helps with breach response and your privacy notice too.
What to include in your reply
The person is entitled to a copy of their personal data, not necessarily every document that mentions them. You can extract the relevant data, but often the simplest way to give context is to provide redacted copies of documents. Alongside the data, you must provide supplementary information, much of which is already in your privacy notice.
| Item | What to say |
|---|---|
| Copy of the data | The personal data itself, in a clear and accessible format |
| Purposes | Why you process their data |
| Categories | The types of data you hold, such as contact, order or payroll data |
| Recipients | Who you share it with, such as payroll providers or couriers |
| Retention | How long you keep it, or how you decide |
| Source | Where you got it, if not from the person |
| Rights | Their rights to rectification, erasure, restriction and objection, and to complain to the ICO |
| Automated decisions | Whether you make decisions about them by automated means, if relevant |
| International transfers | Safeguards if their data goes outside the UK, if relevant |
Redacting third-party data
Documents often contain information about other people: colleagues named in emails, other customers in a spreadsheet, or a manager's opinions. You do not have to disclose other people's personal data unless they agree or it is reasonable to do so without their consent. Consider what the other person would expect, whether the information is already known to the requester and whether there is a duty of confidence.
Redact properly. Black highlighting in a word processor or a black box drawn over a PDF can sometimes be removed. Use a proper redaction tool and check the result before sending.
Example
Imagine a made-up café owner, Priya, who receives a request from a former barista, Tom, three weeks after he left on bad terms. Priya logs it, confirms the request came from Tom's known email, and searches the rota app, payroll software, her email and the staff chat group. She finds 40 messages that mention Tom. She redacts other staff members' names and comments about themselves, keeps the parts about Tom, adds the supplementary information from her staff privacy notice and sends everything in an encrypted file 18 days after receipt.
Fees, refusals and exemptions
Most requests must be handled free of charge. There are limited exceptions:
- Manifestly unfounded requests. For example, where the person clearly has no intention of exercising their right and is using the request to harass, or offers to withdraw it in return for a benefit. The bar is high; a request linked to a dispute is not unfounded just because of the dispute.
- Manifestly excessive requests. For example, repeated requests for the same data at short intervals without good reason.
In those cases you can charge a reasonable fee based on administrative costs or refuse. If you refuse, tell the person why, and that they can complain to the ICO or seek to enforce their right through the courts. Keep a record of your reasoning, because you may need to justify it.
Exemptions can also allow you to withhold some information, for example legally privileged advice, confidential references you have given, or data processed for management forecasting where disclosure would prejudice the business. Exemptions are narrow and apply case by case, so check the ICO guidance before relying on one.
Good practice
- Acknowledge every request quickly
- Keep a log with deadlines
- Search all likely systems, including chat and paper
- Explain any redactions or exemptions in your reply
Avoid
- Asking why the person wants their data
- Deleting data after receiving a request
- Demanding excessive ID documents
- Sending unencrypted files to an unverified address
Prepare before the first request arrives
A little preparation saves hours later. Write a one-page SAR procedure, name a person responsible, and brief staff on recognizing and forwarding requests. Keep your data map current and make sure your retention schedule is followed, since data you have properly deleted cannot be requested.
Under the Data (Use and Access) Act 2025, organizations also need a process for handling data protection complaints. A person unhappy with your SAR response may complain to you first, so connect your SAR log with your complaints process.
Your SAR readiness checklist
- Write a one-page SAR procedure and name an owner
- Train staff to recognize requests made in any form
- Create a SAR log with received date and deadline
- Build a data map of systems, folders and suppliers
- Prepare template acknowledgment, ID, clarification and extension letters
- Choose a proper redaction tool
- Set up a secure way to send responses
- Keep your privacy notice current for the supplementary information
Frequently asked questions
Can I ask why someone wants their data?
You can ask, but the person does not have to answer, and you cannot make a response conditional on a reason. Their motive is generally irrelevant unless the request is manifestly unfounded.
Do I have to include every email that mentions the person?
You need to provide their personal data found through reasonable and proportionate searches. That often includes emails about them, but not every email where their name appears in passing with nothing personal about them.
Can someone make a request on behalf of another person?
Yes, such as a solicitor or relative, if they have the person's authority. Check that authority before disclosing anything.
What happens if I miss the deadline?
The person can complain to the ICO, which may take action. If you are running late, keep the person informed and respond as soon as possible.
Related reading
The bottom line
A subject access request is a legal right, not a nuisance. Log it the day it arrives, verify identity proportionately, search reasonably, redact other people's data carefully and send the data with the supplementary information within one month. A simple procedure and a data map make most requests routine.
Guidance changes as the Data (Use and Access) Act 2025 is commenced, so check the ICO website for current rules and speak to a qualified adviser for complex or contentious requests.
