Have You Received a Subject Access Request? Here’s What to Do

Update: October 2026

A subject access request (SAR) is when someone asks an organisation for a copy of the personal data it holds about them, plus information about how it uses that data. The request can arrive by email, letter, phone call, or social media message, and it can reach any staff member.

This guide covers what to do in the first days, how the deadline works, what the reply must contain, and when you can limit or refuse a response. It follows Articles 12 and 15 of the GDPR, the EDPB’s Guidelines 01/2022 on the right of access and, for UK organisations, the ICO‘s guidance as updated in July 2026.

Key Takeaways

• You must respond without undue delay and within one month of receiving the request. You can extend by up to two further months only if the request is complex or the person has made multiple requests, and you must tell them why within the first month.

• The first copy of the data is free. You can charge a reasonable fee for administrative costs, or refuse, only if the request is manifestly unfounded or excessive, and the EDPB interprets those terms narrowly. You can ask for ID only where you have reasonable doubt, and only as much as is proportionate.

• The person does not have to use a form, quote the GDPR or say why they want the data. A verbal request counts in the UK, and any staff member can receive one. A missed or poor response can lead to a complaint to the regulator, and infringements of data subject rights can be fined up to €20 million or 4% of worldwide annual turnover.

Recognise the Request First, Because It Can Arrive in Any Form

The EDPB states that there are no specific requirements on the format of a request. The controller should offer user-friendly channels. People may use these channels or send the request to any official contact point. The ICO adds that a person does not need to use specific wording, refer to legislation, or direct the request to a specific contact, and that requests can be verbal or made through social media.

The request is valid if it is clear that the person is asking for their own personal data. A message such as “send me everything you have on me” is enough. Customer service, HR, and social media staff need to know that such a message must go to whoever handles SARs that day.

Record the date of receipt. The EDPB says the one-month period starts when the controller receives the request, and it recommends confirming receipt to the person.

The One-Month Deadline Starts on Receipt

Article 12(3) requires the controller to provide information on the action taken without undue delay and in any event within one month of receiving the request. The EDPB adds that it may extend the time by two further months where necessary, taking into account the complexity and number of requests, and that the person must be told the reason for the delay.

The ICO sets out the same position for UK organisations. The time limit runs from receipt, or from receipt of the information needed to confirm identity, evidence that a third party may act for the person, or a fee where one is allowed. If you extend, you must tell the person why within the first month. The ICO says the extension applies when the request is complex, or the person has made multiple requests.

In the UK, the ICO guidance, updated on 16 July 2026 for the Data (Use and Access) Act 2025, also lets you pause the clock. If you ask the person to clarify what they want and the clarification is reasonably required, the one-month limit stops on the day you ask and resumes the day after you receive the answer. You cannot force the person to narrow the request. Under the EDPB guidelines, asking for clarification does not affect the controller’s duty to act without undue delay, so organisations in the EU should not assume the clock stops.

Confirm Identity Without Collecting More Than You Need

You must be sure that you are sending the data to the right person. The EDPB says that where there are reasonable doubts about identity, the controller may request additional information to confirm it, and that the request must be proportionate to the type of data processed and the damage that could occur, to avoid excessive data collection.

The ICO takes the same approach. It says to be reasonable and proportionate, request formal identification only if necessary, and ask as early as possible because the time limit doesn’t start until you receive the information you requested. If a customer emails from the email address on their account, it’s hard to justify asking for a passport copy.

If a third party requests someone else’s data, such as a solicitor or relative, you need to be satisfied they are entitled to act. The ICO says the third party must provide evidence of their authority.

Search Every System Where the Person’s Data Sits

The EDPB says the controller must search for personal data across all IT systems and non-IT filing systems, using search criteria that match how the information is structured, such as name and customer number. That includes email, CRM records, HR files, call recordings, CCTV where the person is identifiable, and paper files.

Where you hold a large quantity of data about the person, the EDPB says you may ask them to specify the request. In that case, the controller should also provide meaningful information about its processing operations that could concern the person. In the UK, the ICO says you must make a reasonable and proportionate search and need not carry out searches that are unreasonable or disproportionate to the importance of the information.

Controllers are not required to provide data they have already deleted under their retention policy. The response should cover the data available at the time of the request.

The Reply Needs a Copy of the Data and Supporting Information

Article 15 gives the person three things: confirmation of whether you process their data, access to that data, and the information listed in Article 15(1) and (2). That information covers the purposes of the processing, the categories of data, the recipients, the retention period or the criteria for setting it, the person’s rights to rectification, erasure, restriction and objection, the right to lodge a complaint with a supervisory authority, the source of the data if you did not collect it from the person, the existence of automated decision-making including profiling, and the safeguards used for any transfer to a third country.

The EDPB says the copy must be complete, not just a summary. It refers to a copy of the personal data and does not require reproducing the original documents. The first copy must be free of charge, even if the controller believes reproduction costs are high. Where the person makes the request electronically, you provide the answer in a commonly used electronic form unless they ask otherwise.

The EDPB notes that an email can be used with appropriate safeguards, and that a self-service tool is an option. The ICO says the controller must take all reasonable steps to ensure the information is delivered securely and that it is clear and accessible to the person. Remote access to a secure system can satisfy the request only if the person can download a copy, and anyone unable or unwilling to use the platform must get a reply by another method.

Other People’s Data in the Records Needs a Careful Check

A record about the requester often mentions someone else, such as a colleague, a family member or a complainant. Article 15(4) says the right to obtain a copy must not adversely affect others’ rights and freedoms. The EDPB says applying it should not lead to refusing the whole request. It should be used to redact or make illegible parts that could harm others.

The ICO says you do not have to provide information that would reveal another person, unless that person has consented or it is reasonable to disclose without consent. It recommends a three-step approach, set out in its detailed guidance on information about other people. Document the decision for each redaction.

Fees and Refusals Are Allowed Only in Limited Cases

Article 12(5) says information is provided free of charge. The controller may charge a reasonable fee based on administrative costs or refuse to act where the request is manifestly unfounded or excessive, and the burden is on the controller to show that the request meets the test. The EDPB interprets these concepts narrowly and, because Article 15 has few prerequisites, limits the room to call a request manifestly unfounded. The ICO describes a high threshold. Under Article 15(3), a reasonable fee based on administrative costs may be charged for any further copies the person requests.

National law can also restrict the right under Article 23, and in the UK the Data Protection Act 2018 sets out exemptions, such as legal professional privilege and confidential references. The ICO says to consider each exemption case by case, to document the reasons, and to withhold only what the exemption covers.

When you do not act on a request, Article 12(4) requires you to tell the person without delay, and at the latest within one month, why you did not act and that they can complain to a supervisory authority and seek a judicial remedy. The ICO says the notice should also tell them they can complain to you as the controller.

A Written Procedure Prevents Missed Deadlines

An organisation that handles one SAR a year can still miss the deadline, because the request often sits in the wrong inbox. The EDPB says controllers should be prepared for requests, with procedures that suit the nature and risk of their processing. A workable procedure names the person who owns SARs, tells staff to forward any request the day it arrives, and sets out how to log the date, check identity, search the systems, review for third-party data, and send the reply securely.

The ICO adds that an organisation should have a policy for recording verbal requests, a way to find data in its systems, and staff training. It also says that forcing someone to make a SAR, for example, by requiring an employer to provide their criminal record, is a criminal offence in the UK.

GDPRLocal helps organisations build SAR procedures, train staff and handle complex requests. See our GDPR consultant services.

Conclusion

A SAR is simple on paper. The person asks for their data, you confirm who they are if there is real doubt, search your systems, remove what belongs to others, and send a copy with the Article 15 information inside one month. The deadline begins when the request arrives, in whatever form it arrives.

Limits apply to manifestly unfounded or excessive requests, third-party data, and national exemptions, and you must justify and record each. Organisations that handle SARs well have a named owner, a dated log, and a rule that staff forward any request immediately.

Frequently Asked Questions

How much time do I have to respond to a SAR?

You have one Month to respond, with a possible extension of two more months. The month starts on receipt, under Article 12(3). You can extend by up to two more months if the request is complex or the person made several requests, and you must tell them the reason within the first month.

Can Refuse a SAR?

Article 12(5) allows refusal, or a reasonable fee, where a request is manifestly unfounded or excessive, and you must be able to show it. National law exemptions can also apply. If you refuse, you must tell the person why and how to complain to the supervisory authority and to a court.

What are the requirements for a SAR?

The EDPB says there are no specific format requirements, and the ICO confirms that SARs can be made verbally or in writing, including through social media. The person does not need to cite the GDPR or direct the request to a specific contact.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.