Subject Access Request Support

What a subject access request is

A Subject Access Request (SAR), often called a DSAR (data subject access request), is a request from an individual for a copy of the personal data you hold about them, together with information about why you hold it, who you share it with and how long you keep it. It is one of the strongest rights under UK GDPR, it can be made verbally or in writing to anyone in your organisation, and it does not have to mention the law or use the words “subject access”.

The rules that trip organisations up are simple to state and hard to apply:

• You must respond within one calendar month of receiving the request. You can extend by up to two further months only if the request is genuinely complex or you have received several from the same person, and you must tell them within the first month.
• You cannot normally charge a fee. You can only charge, or refuse, where a request is manifestly unfounded or excessive, and you need to be able to justify that.
• You must provide all of the requester’s personal data, wherever it lives: email, shared drives, case-management systems, HR files, meeting notes, messaging apps and personal devices used for work.
• You must protect other people’s data. Information that identifies someone else has to be redacted unless they consent or it is reasonable to disclose it without consent.
• You must apply the exemptions correctly, and only where they genuinely apply.

Who asks for help with SARs

Most of the requests we see fall into three groups:

Type of request	Why it is difficult
Employee or ex-employee requests, usually alongside a grievance, disciplinary or tribunal claim	Large volumes of email, references to colleagues throughout, and a requester who will scrutinise every redaction
Patient, service-user or family requests for health and care records	Third-party information, professional opinions, safeguarding material and, occasionally, the serious-harm exemption
Customer, supporter or complainant requests	Data spread across CRM, ticketing, marketing and finance systems, often with no single owner

If you receive one of these a few times a year, doing it in-house is a real cost: a manager or practice lead loses a fortnight, and the risk of a mistake is high. If you receive them regularly, a repeatable procedure and outside capacity are worth having.

What “SAR redaction” actually involves

Redaction is not blacking out names. It is a set of judgements, made consistently and recorded:

1. Identify third-party data. Anyone other than the requester who appears in the material. Colleagues acting in a professional capacity are often reasonable to disclose; other patients, family members and complainants usually are not.
2. Separate the requester’s data from other content. A long email chain may contain only a paragraph about the requester. You provide that paragraph, not the chain.
3. Apply exemptions where they apply. Legal professional privilege, management forecasting, negotiations, confidential references, and, for health and social care records, the serious-harm test. Each one has conditions.
4. Record every decision. A disclosure log that shows what was found, what was provided, what was withheld and under which provision. If the requester complains to the ICO, this log is what the ICO will ask for.
5. Explain the response. A covering letter that tells the requester what you searched, what you are providing, and that some material has been withheld and broadly why.

How we work

Triage within two working days. We confirm the request is valid, check whether you need to verify identity, clarify the scope if it is genuinely unclear, and set the deadline in writing.

A search plan you can defend. We list the systems and people to search, the date ranges and the search terms, and we record them. Searches are carried out by your team with our guidance, or by us where you give us access.

Review and redaction. We review the collated material, apply third-party redaction and exemptions, and prepare the bundle. For care and health records we work with your clinical or care lead on the serious-harm question.

A response that closes the request. A covering letter, the bundle in a usable format, the supplementary information UK GDPR requires, and the disclosure log kept on file.

A procedure for next time. If you do not already have one, we leave you with a written SAR procedure and template letters. Our free SAR procedure is the starting point.

Evidence and documents involved

A well-handled SAR produces a small file of its own: the request and any clarification, the identity check, the search plan, the disclosure log, the covering letter and the bundle. Keep that file for as long as the requester could complain or bring a claim. If you have a record of processing activities and a retention schedule, both make the search faster, because you already know where personal data lives and what should already have been deleted.

Common mistakes

• Missing the request because it arrived by phone, social media or in the middle of a complaint, and nobody recognised it.
• Letting the clock run while waiting for identity documents you did not actually need.
• Over-redacting colleagues’ names and professional comments, which the ICO regularly criticises.
• Under-redacting other patients, family members or complainants.
• Withholding whole documents because part of them is exempt, rather than redacting the exempt part.
• No disclosure log, so when the requester complains, nobody can show what was done.
• Treating a tribunal-linked SAR as a litigation exercise and refusing it. The right of access is independent of the dispute.

How it relates to the other standards

Subject access sits inside your wider UK GDPR obligations, and an outsourced DPO is the natural owner of the process where you have one. For health and care providers the DSPT asks how you handle individuals’ rights, and a documented SAR procedure is part of that evidence. Our step-by-step guide to handling subject access requests covers the process in more detail, and the glossary explains any unfamiliar terms.

How 360 Cyber Compliance helps

We handle the request end to end or support your team through it, at a fixed fee agreed up front. For a one-off request, that means triage, a search plan, redaction and a compliant response inside the deadline. For organisations that receive requests regularly, it means a monthly retainer, a procedure your team can follow, and someone to call when a difficult one arrives.

We give practical, honest advice about what must be disclosed and what can be withheld. We do not guarantee that a requester will be satisfied, but we make sure that if they complain, you can show the ICO exactly what you did and why. Get in touch to talk through a request you have received, or a backlog you need to clear.