How to Respond to a Subject Access Request

The short answer: responding to a subject access request

A subject access request is a request by an individual for a copy of their personal data and information about how it is used. In the UK, you must respond without undue delay and within one month, which can be extended by two further months for complex or numerous requests. You must carry out a reasonable and proportionate search, disclose the data and supporting information, and withhold only what an exemption or third-party rights genuinely protect.

Since 5 February 2026, the rules on when the clock starts and stops are set out in statute, and since 19 June 2026 a dissatisfied requester can complain to you directly under a new complaints duty. Requests made to gain an advantage in a dispute are still valid requests, so the motive rarely gets you out of answering.

The legal framework

The right of access is in Article 15 of the UK GDPR. It entitles the individual to confirmation that their data is being processed, a copy of the data, and supporting information: the purposes, the categories of data, the recipients, the retention period, the source, the existence of automated decision-making, and their rights, including the right to complain. Exemptions are in Schedules 2 to 4 of the Data Protection Act 2018.

The Data (Use and Access) Act 2025 made three changes. Section 78 confirms that the requester is entitled only to what the controller can provide based on a reasonable and proportionate search, treated as in force from 1 January 2024. Section 76 inserted a new Article 12A, defining the time limit and when the clock starts, from 5 February 2026. And section 103 created the complaints duty from 19 June 2026. Our guide to the Data (Use and Access) Act explains the wider reforms.

The regulator, now the Information Commission (still the ICO), updated its right of access guidance in early 2026 to reflect these changes.

Time limits: when the clock starts, stops and extends

Under Article 12 and the new Article 12A, the response period is one month beginning with the latest of three events: receipt of the request; receipt of any information you reasonably asked for to confirm the requester's identity; and payment of any fee you are entitled to charge.

The clarification pause applies where you reasonably need more information to identify the data or processing the request relates to. The statute gives the example of a controller processing a large amount of information about the individual, but the ICO's updated guidance treats that as an example rather than a precondition. Asking for clarification should not become a delaying tactic; the request must still be answered if the individual declines to narrow it.

Reasonable and proportionate searches

You must make reasonable efforts to find the requester's data across your systems: email, document management, HR and CRM systems, messaging platforms such as Teams or Slack, backups where accessible, and personal devices used for work. You are not required to carry out searches that would be unreasonable or disproportionate, and since the 2025 Act that limit is in statute.

What counts as proportionate depends on the circumstances, the difficulty of the search, the volume of material and the fundamental nature of the right of access. The burden is on you to justify any limit. Document the systems searched, the search terms, the date ranges, the custodians and the reasons for excluding anything, because that record is your defence if the regulator or a court reviews the response.

The search log is the most valuable document in any subject access request response: it is what shows the search was reasonable.

A step-by-step response process

1. Recognise and log the request. A request can be made orally, by email or on social media, and need not mention data protection law. Record the date of receipt and route it to the data protection lead.
2. Confirm identity proportionately. Ask for identity information only if you have reasonable doubt, and only what you need. Check that third parties acting for the requester, such as solicitors, have authority.
3. Clarify scope where reasonably required. If you hold a large amount of data, ask focused questions about the information or time period sought; the clock pauses until the reply.
4. Search and collate. Run a documented search across relevant systems and custodians, and preserve the results.
5. Review and redact. Separate the requester's personal data from other material, apply exemptions where justified and handle third-party data under the balancing test.
6. Prepare the response. Provide the data in a concise, intelligible and accessible form, with the supporting information required by Article 15, including the right to complain to you and to the regulator.
7. Send, record and review. Send securely within the deadline, keep a record of what was disclosed and withheld, and note lessons for future requests.

What the response must contain

A complete response to a subject access request has two parts. The first is a copy of the personal data, in a concise, transparent, intelligible and easily accessible form. If the request was made electronically, provide the data in a commonly used electronic format unless the requester asks otherwise. The ICO's updated guidance accepts that a secure self-service download can satisfy the copy requirement where the requester does not object.

The second part is the supporting information: the purposes of processing, the categories of data, the recipients or categories of recipients (with specific recipients named unless that is impossible or the request is manifestly unfounded or excessive), the retention period or criteria, the source of data not collected from the individual, any automated decision-making and its logic, any international transfer safeguards, and the individual's rights, including the right to complain to you and to the regulator.

Requests made through third-party services

Some requests now arrive through online services that generate requests on behalf of consumers, sometimes in large numbers. Each is still a subject access request if the individual has authorised it. You can check that the service has authority and confirm identity where you have reasonable doubt, but you should not ignore such requests or impose obstacles that would not apply to a request made directly.

Exemptions and third-party data

Exemptions must be applied case by case, not as blanket categories. The most commonly used are:

• Legal professional privilege: privileged communications with lawyers can be withheld. See our guide to legal professional privilege.
• Negotiations: records of your intentions in negotiations with the requester, where disclosure would prejudice them, such as a settlement strategy.
• Management forecasts: data processed for management forecasting or planning, where disclosure would prejudice the business.
• Confidential references: references given in confidence for employment, education or similar purposes.
• Crime and taxation: where disclosure would be likely to prejudice the prevention or detection of crime.

Where the requester's data is mixed with information about other people, you can disclose the third party's information only if they consent or it is reasonable to disclose without consent, considering any duty of confidentiality, the steps taken to seek consent and the third party's interests. Redaction is usually the answer, but over-redaction is a frequent source of complaints. The ICO's updated guidance also confirms that exemptions can apply to the supporting information, such as specific recipients, not only to the data itself.

Litigation-driven DSARs

Many requests arrive alongside employment claims, grievances, professional disputes or commercial litigation. The requester's motive does not, by itself, make a subject access request invalid or manifestly unfounded: the courts have long accepted that an individual may use the right of access even where they also hope to gain information for a dispute. A request may be manifestly unfounded where it is not genuinely about exercising the right, for example where it is made purely to harass or disrupt, but that is a high bar and you must be able to justify it.

Litigation-driven requests need joined-up handling. The response should be consistent with any disclosure obligations in the proceedings, privileged material should be identified early, and the review team should know what has been said in the dispute. In employment tribunal proceedings, for example, a DSAR response is often scrutinised as closely as formal disclosure. Our employment team and litigation team coordinate with data protection advice on these matters.

Group companies and cross-border requests

In a corporate group, each company that is a controller of the requester's data must respond to a subject access request made to it, but requests are often sent to the parent or to whichever entity the individual knows. Agree in advance how requests are routed within the group and which entity responds, and say in the response which controllers it covers.

Where data is held by overseas group companies or processors, for example in Bangladesh, the Gulf or Singapore, the UK controller remains responsible for retrieving it within the deadline. Processor contracts should require prompt assistance. If the requester is also covered by the EU GDPR, the core rules are similar, but the 2025 UK reforms on time limits and searches have no direct EU equivalent, so global procedures should note the differences.

Illustrative scenario: an employee's request during a grievance

This scenario is illustrative only. A senior employee raises a grievance, then emails HR asking for "all data you hold about me", including emails in which they are mentioned. The company has many years of email and chat data.

The company logs the request, acknowledges it, and asks focused clarification questions about the time period and the issues of most interest, pausing the clock. It agrees custodians and search terms, documents why certain archived systems are excluded as disproportionate, and reviews the results with privilege and negotiation exemptions in mind, keeping a note of each redaction.

Because the volume is large and the employee has made several related requests, the company notifies an extension within the first month, with reasons. It provides the response with an explanation of the search and exemptions, and a route to complain under its new complaints procedure. If the matter later reaches a tribunal, the search log supports the company's position.

Risks and common mistakes

What to do next

A well-handled subject access request depends on preparation: a logged intake process, a search methodology, redaction rules and template responses. Our data protection solicitors can review your procedure, train teams or handle a sensitive request, particularly where a dispute is under way. Our UK GDPR compliance checklist covers the wider framework.

Before the next request arrives, check that you have:

• a single intake route and log, with the date of receipt recorded for every request;
• a proportionate identity verification standard and a template clarification letter;
• a list of systems and custodians to search, with a search log template;
• redaction rules for third-party data and a schedule for recording exemptions;
• template responses that include all the supporting information Article 15 requires;
• a complaints route that meets the 30-day acknowledgement duty.

For help with a live request, contact our London office or email info@trw.co.

Frequently asked questions

Sources and official materials

1. Data (Use and Access) Act 2025, section 76 — Time limits and Article 12A UK GDPR
2. Data (Use and Access) Act 2025, section 78 — Reasonable and proportionate searches
3. Data (Use and Access) Act 2025, section 103 — Complaints by data subjects to controllers
4. UK GDPR Article 12 — Modalities for exercising rights, fees and refusals
5. Data Protection Act 2018 — Exemptions in Schedules 2 to 4
6. Information Commission (ICO) — Right of access guidance

General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.