Subject access request procedure

A subject access request can arrive as a formal letter, a line in a complaint or a comment to a member of staff, and the business has a month from the day it arrives to find everything it holds about the person, decide what it can withhold, and send the rest in a usable form. Most businesses handle their first one badly because nobody recognised it, nobody knew where to look and nobody knew what could be left out. The procedure covers recognition, the handler, the search, the exemptions and the response. I draft the procedure with the data processing agreement and the privacy notice for the business for a fixed fee of £795, delivered in five working days, with a note on the operational steps the documents assume.

Who this is for

Businesses in England and Wales that have received a subject access request, expect one from a departing employee or an unhappy customer, or want the procedure in place before the first one arrives.

What matters in a subject access request procedure

Recognising a request and starting the clock

Article 15 of the UK GDPR gives an individual the right to obtain confirmation that the business processes their data, a copy of it and the information Article 15(1) lists, and the request needs no particular form, no mention of the law and no particular recipient, so the procedure's first job is to tell every member of staff what a request looks like ('send me everything you hold on me', 'I want to see my file') and where to send it, because the one-month period under Article 12(3) runs from receipt by the business, not from the day the right person sees it; the procedure names the handler and the inbox, and the privacy notice tells individuals how to make a request, which channels most of them through the route the business can manage.

Identity, clarification and the time the business has

The business may ask for reasonable proof of identity where it has doubts (and the Data (Use and Access) Act 2025 confirms on commencement that the time limit does not run until identity is confirmed), may ask the requester to clarify what they want where it holds a large amount of data (with the time limit paused until they reply, where the clarification is reasonably required), and may extend the month by up to two further months for a complex request or a number of requests, telling the requester within the first month why; the procedure sets out the proportionate identity check, the clarification letter and the extension letter, with the dates logged.

The search, the systems and what a reasonable search is

The business must search the systems where the person's data is likely to be held (the CRM, the accounts system, email, shared drives, messaging tools, HR systems, paper files, CCTV where the person asks for footage, backups only where reasonable), and the search must be reasonable and proportionate, which the 2025 Act writes into the law on commencement and the Information Commissioner's guidance has long said: the business is not required to search every backup tape or to reconstruct deleted data, but it is required to look properly and to describe what it searched; the procedure contains the search checklist for the business's systems, the search terms and the record of the search, because 'we looked and found nothing' has to be a statement the business can stand behind.

What to provide and what to withhold

The response must include a copy of the personal data (the data about the person, not every document that mentions them, in a commonly used electronic form where the request was electronic), the purposes, the categories, the recipients, the retention period, the source where not from the person, the existence of automated decision-making and the person's rights, and it must be free of charge unless the request is manifestly unfounded or excessive (a high bar: repetition, or a request made to harass, not a request that is inconvenient); the business may redact what is not the requester's data and what falls within an exemption, and the template response lists what is provided, what has been withheld and why.

Third parties, references and the exemptions that matter

Where the data includes information about another person, Article 15(4) and the Data Protection Act 2018 require the business to balance the requester's right against the other person's, disclosing with the other person's consent or where it is reasonable without it (and redacting the rest), and the exemptions in Schedule 2 to the Act that a business most often needs are legal professional privilege (advice from the business's lawyers), confidential references given or received for employment, management forecasting and planning (a restructuring not yet announced), negotiations with the requester (the business's position in a settlement discussion), and crime and tax; the procedure explains each in a line, requires the handler to record which was applied to what, and tells them to take advice where the request comes with a dispute.

The response, the log and the request that is really a dispute

The response goes out within the time limit, securely (encrypted, or through a portal, not as an unprotected attachment), with the covering letter explaining what was searched, what is enclosed, what was withheld and why, and the person's right to complain to the Information Commissioner's Office and to go to court; the business keeps a log of every request (received, identity confirmed, clarified, extended, responded, exemptions applied) because the regulator asks for it, and the procedure recognises that a request from a departing employee, a customer in a dispute or a solicitor is usually a step in something else, in which case the response is prepared with the dispute in mind, the hold under the retention policy is applied and the business takes advice; the data processing agreement drafted alongside requires the business's processors to assist with requests, and the privacy notice states how a request is made.

What it costs

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Review of a customer's DPA, £495. They sent theirs and you need to know what you are accepting. Returned marked up with the changes to ask for and an explanation. Three working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

A customer has emailed asking for 'everything you have on me'. Is that a subject access request?

It is. No form, no mention of the law and no particular recipient is needed, and the month runs from the day the email arrived. The procedure tells staff to recognise it and route it to the handler at once.

Do we have to search every email ever sent?

A reasonable and proportionate search of the systems where the person's data is likely to be, which the law now states and the regulator has long applied. The procedure contains the checklist for your systems and the record of what was searched.

Can we withhold the internal emails about the person's complaint?

Only what an exemption covers: legal advice, confidential references, management planning not yet announced, the business's negotiating position, and the other people's data redacted. Internal opinions about the person are their data and are usually disclosed. The procedure explains each exemption and records which was applied.

Related guidance and services

• Data protection agreements and privacy terms, £795, the service this page describes
• SaaS and technology contracts, £995
• Terms and conditions drafting, £995
• Data retention policy
• Data breach response plan

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.