Respond to data subject access requests (DSARs)

A data subject access request (DSAR) is a request from an individual to see the personal data you hold about them. Under UK GDPR Article 15, people have the right to access their personal data, and you must respond within legal timeframes.

Requests can come from customers, employees, former staff, suppliers or anyone else whose personal data you hold.

Getting DSARs wrong exposes your business to enforcement action by the Information Commission (formerly the ICO). Breach of data subject rights falls under the higher tier of UK GDPR fines.

Recognising a DSAR

A DSAR does not need to use specific wording or follow a particular format. You must treat any of these as a valid request:

• written requests by email, letter, online form, text message or social media message
• verbal requests by phone, video call or face to face
• any clear expression of intent, such as "I want to see my data", "What do you have on me?" or "Send me everything you hold about me"

The person does not need to mention 'DSAR', 'subject access request', 'Article 15', or 'UK GDPR'. If their intent is clear, it's a valid request.

Train your staff to recognise DSARs. Requests may arrive through unexpected channels - customer service, social media, or informal conversations with managers.

Your legal deadline

You must respond within one calendar month from when you receive the request.

Calculating the deadline

The deadline falls on the corresponding date in the following month:

• Request received 15 March - deadline 15 April
• Request received 31 January - deadline 28/29 February (last day of month)
• Request received 30 November - deadline 30 December

The clock starts when the request arrives, not when you begin processing it. If you ask for proof of identity, it starts when you receive it. Log all requests immediately with the date received.

The extension is only for requests that are complex or for a number of requests from the same person. Your own workload is not a reason to extend.

The 'stop the clock' provision

From 5 February 2026, the Data (Use and Access) Act 2025 allows you to pause the response deadline when you need to ask for clarification.

This is useful when requests are unclear or extremely broad. For example:

• Request asks for "all my data" across multiple systems - you can ask which records they actually need
• Request doesn't identify the person clearly - you can ask for clarification
• Request covers a very long time period - you can ask them to narrow the scope

Do not use this provision to create unnecessary delays. Only request clarification when genuinely needed to fulfil the request effectively.

Verifying identity

Before releasing personal data, you must be confident the request comes from the right person. Releasing data to the wrong person is itself a data breach.

Proportionate verification

What counts as reasonable verification depends on the sensitivity of the data and how the request was made:

• For low-risk data, a request from an email address already on file may be enough.
• For medium-risk data, ask them to confirm details only they would know, such as a recent transaction, account number or address.
• For sensitive information, you may ask for photo ID, if that is proportionate.

Do not over-verify. Asking for certified passport copies to confirm a mailing list address would be excessive. Match the verification level to the risk.

Third party requests

Someone can make a DSAR on behalf of another person - a solicitor for a client, a parent for a child, or an employee representative. You must be satisfied they have authority to act.

Ask for:

• Written authorisation from the data subject
• Evidence of legal authority (power of attorney, court order)
• For children under 13, evidence of parental responsibility

If in doubt, contact the data subject directly to confirm they want the data released to the third party.

What you must provide

A DSAR response must include both the personal data and supplementary information about how you process it:

• a copy of all the personal data you hold about them, in an accessible format
• why you are processing it
• what types of personal data you hold
• who you have shared it with or will share it with
• how long you keep it, or how you decide that
• their rights to rectification, erasure, restriction and objection, and to complain to the Commission
• where the data came from, if not from them
• any automated decision-making affecting them, and the logic involved

Conducting reasonable searches

You must conduct a reasonable and proportionate search for personal data across all your systems. This includes:

• Databases, CRM systems, and business applications
• Email accounts (including archives)
• Paper files and physical records
• Backup systems
• CCTV footage
• HR records, finance systems, call recordings

The Data (Use and Access) Act 2025 clarified that searches should be "reasonable and proportionate" - you don't need to search every possible location exhaustively, but you must make genuine efforts to locate all relevant data.

Format of your response

Provide the information in a commonly-used electronic format if the request was made electronically. PDF, CSV, or structured exports from your systems are usually acceptable.

If the person requests a specific format and it's reasonable, you should try to comply. You don't need to build custom export tools.

When you can refuse or redact

UK GDPR and DPA 2018 contain exemptions that allow you to withhold some information. Apply these carefully - they are not blanket refusals. The main ones cover:

• personal data about other people, which you redact unless they have consented or disclosure is reasonable without consent
• confidential communications with lawyers for legal advice (legal professional privilege)
• references given in confidence for employment, education, training, volunteering or an appointment, whether you gave or received them
• management forecasting or planning about negotiations or decisions that disclosure would prejudice
• data processed to prevent or detect crime, if disclosure would prejudice those purposes
• requests that are manifestly unfounded or excessive, such as vexatious or repetitive requests, which is a high bar to prove

When you apply an exemption:

• Exemptions apply to specific pieces of information, not whole documents
• Redact the exempt parts and provide the rest
• Always consider whether a partial response is possible
• Document your reasoning for applying each exemption

If you refuse or redact, tell the individual within the response deadline. Give your reasons and tell them they can complain to you, complain to the Information Commission, or go to court.

Fees

Subject access requests are free in most cases.

What makes a request 'manifestly unfounded or excessive'?

This is a high bar. Examples that might qualify:

• A request may be manifestly unfounded if the person clearly has no intention of exercising their rights, for example making threats or demands unrelated to data access.
• A request may be excessive if it repeats, such as the same person asking for identical data every week without good reason.

Size alone is not enough. A large request for substantial data is not automatically excessive. The test considers whether the request is reasonable in the circumstances, not the volume of work involved.

Requests from employees and former employees

Requests from staff and former staff usually involve large volumes of data across many systems and raise harder exemption questions than customer requests.

• Employee records are spread across HR files, emails, performance reviews, disciplinary records, payroll, pensions, occupational health, CCTV, access logs and internal messages.
• Workplace documents often mention other employees, managers and customers, so you need to review each document and redact other people's data where necessary.
• Confidential references are exempt, whether you gave them or received them.
• Notes about redundancies, restructuring or succession planning may be exempt as management forecasting, if disclosure would be likely to prejudice the business.
• If a dispute is under way or expected, communications with your legal advisers are likely to be covered by legal professional privilege.
• Requests often arrive during a grievance or disciplinary process. Handle the request on its own terms, whatever the background.

Handling a staff request

• Give it to someone senior enough to see all the records, with access to legal advice.
• Search HR, email and operational systems thoroughly.
• Keep the response separate from any grievance, disciplinary or tribunal process.
• Keep a record of the searches you ran and each redaction decision.

Step-by-step DSAR response process

Follow these steps for every data subject access request:

If the individual is not satisfied

From 19 June 2026, anyone can complain to you directly if they think you have broken data protection law in handling their data. You must make complaining easy, for example with a complaint form that can be completed electronically and by other means.

• Acknowledge each complaint within 30 days of receiving it.
• Look into it and keep the person informed of progress.
• Tell them the outcome without undue delay.

If the individual remains dissatisfied after your internal process:

• Inform them of their right to complain to the Commission
• The Commission can investigate and order you to take specific actions
• The Commission can issue enforcement notices and fines

Penalties for getting it wrong

Failing to respond correctly to DSARs can result in significant penalties. Breach of data subject rights falls under the higher tier of UK GDPR fines:

Common compliance failures that trigger enforcement:

• Not responding within one month
• Providing incomplete information
• Applying exemptions incorrectly or too broadly
• Failing to recognise a valid DSAR
• Charging fees when not permitted
• Not telling the individual about their right to complain
• Releasing data to the wrong person, which is a data breach in itself

Be ready before a request arrives

• A written procedure naming who handles requests, how staff pass them on and the steps to follow. Write it yourself and share it with every member of staff who could receive a request.
• A request register logging each request, its date of receipt, the searches made, any exemptions applied and the date you responded. A spreadsheet is enough for most small businesses.
• Trained staff. Anyone who deals with customers, staff or suppliers should be able to spot a request and pass it on the same day.
• A map of where personal data is held across your systems, so you can search quickly. Build it from your record of processing activities or an audit of your systems.
• A route to legal advice for requests linked to a workplace dispute, a regulatory investigation or legal proceedings.