# How to handle a subject access request How to recognise, time, search, redact and answer a subject access request within the UK GDPR and EU GDPR deadlines, with the UK pause rules. Source: https://sted.digital/docs/guides/data-subject-access-requests · Last reviewed 17 October 2026 · Strand Guides Log the request the day it arrives, confirm the person's identity only if you have real doubt, and work out the due date in calendar months. Search every system that holds their data, proportionately. Review what you find for other people's data and exemptions, redact, and send a free, readable copy with the required explanations before the deadline. ## When you need this Anyone can ask you for a copy of their personal data and facts about how you use it (UK GDPR Article 15 and EU GDPR Article 15). In the UK the time limit is the applicable time period in UK GDPR Article 12A, inserted by Data (Use and Access) Act 2025 section 76: one month from the relevant time, extendable by two further months for complex or numerous requests. Data (Use and Access) Act 2025 section 78 added UK GDPR Article 15(1A), which limits the search to what is reasonable and proportionate. EU GDPR Article 12(3) sets one month from receipt, extendable by two. Requests come from customers, former employees in a dispute, patients and job applicants, by any channel and in any words. A privacy or operations lead usually runs them, with HR or IT doing the search. This is guidance to help you understand the requirement, not legal advice. ## Before you start You need a named owner for requests, a log, and a search plan listing every system that holds personal data, taken from your [record of processing](/docs/glossary/records-of-processing). Know who can run searches in email, chat, the HR system and the CRM, and who can redact. Agree who decides on exemptions; a [data protection officer](/docs/glossary/data-protection-officer), where you have one, should be consulted. A simple customer request takes two to four hours. A former employee's request covering years of email can take several days of review. ## Steps 1. Recognise the request. Any request for "my data" in any channel counts, and it need not mention the law. Done when it reaches the request owner the same day. 2. Log the request with the date of receipt, the channel, the right asked for and a provisional due date. Done when the log entry exists. 3. Verify identity only where you have reasonable doubt, using information you already hold where possible (UK GDPR Article 12(6)). In the UK the month starts when the identity information arrives. Done when identity is confirmed and the due date is updated. 4. Clarify the scope where you hold a large amount of data and the request is unclear. In the UK the days between asking and receiving the reply do not count towards the deadline. Done when the scope is agreed or the person declines to narrow it. 5. Search each system in the search plan for the person's data, proportionately. Done when the search terms, systems and dates are recorded. 6. Collate the results and review them for other people's data and for exemptions. Done when each withheld item has a recorded reason. 7. Redact third-party data and exempt material. Have a second person check the redactions. Done when the checked copy is ready. 8. Respond with the copy and the supporting information: purposes, categories, recipients, retention, source, rights and how to complain. Provide it free of charge, and in a commonly used electronic form when the request came electronically (UK GDPR Article 15(3)). Done when the reply is sent and its date is logged. 9. Record the outcome and keep the response file: the request, identity evidence, search record, redaction decisions and the reply. Done when the file is complete and stored with the log entry. 10. Handle any complaint about the response under your complaints procedure. From 19 June 2026, UK controllers must have one and acknowledge each complaint within 30 days (Data Protection Act 2018 section 164A). Done when the complaint is acknowledged and answered. ## Exemptions a small firm actually meets Most refusals and redactions fall under four headings. Apply each item by item, not to whole documents, and record why. ### Other people's data UK GDPR Article 15(4) says the copy must not adversely affect other people. Redact a colleague's name or details unless they consent or it is reasonable to disclose them without consent, for example because the requester already knows the information. Weigh the third party's expectations and any duty of confidence. ### Legal advice Communications with your lawyers about the requester, and material prepared for litigation, can be withheld under the legal professional privilege exemption in Data Protection Act 2018 schedule 2. Withhold the advice, not every email that mentions the dispute. ### Confidential references A reference about the person given in confidence, for employment, education, training or a similar purpose, can be withheld under the same schedule, whether you wrote it or received it. The exemption needs the confidence: a reference given on an open basis is disclosable. ### Management forecasts and negotiations Plans for the person's future, such as a redundancy forecast, and your intentions in a live negotiation with them can be withheld while disclosure would prejudice the business or the negotiation. Once the restructure is announced or the deal is done, the reason usually falls away. ## Worked examples ### UK GDPR, a former employee's request to a 45-person firm Priya, who left a 45-person software firm in January, emails the head of operations on Tuesday 3 March 2026 asking for "all data you hold about me". The request is logged that day. Her email comes from a new personal address, so the firm asks on 4 March for a copy of her old staff ID card. It arrives on 9 March, and the relevant time becomes 9 March: the month runs to 9 April 2026. The firm holds six years of her email, so on 12 March it asks whether she wants every message that mentions her or particular topics. She replies on 16 March: messages about her performance and her exit. Under UK GDPR Article 12A the five days from 12 to 16 March do not count, so the due date moves to 14 April 2026. The search covers the HR system and Microsoft 365. A search for her name and both addresses returns 1,840 messages; the agreed scope brings that to 312. Review leads to two redactions: a colleague's name and comments in a grievance statement (other people's data, no consent), and an email from the firm's employment solicitor (legal privilege). The reply goes out on 8 April 2026 as a password-protected PDF, with a covering letter that lists the systems searched, the two exemptions relied on and how to complain. ### EU GDPR, the same request to the Dublin office If Priya had worked for the firm's Dublin entity, EU GDPR Article 12(3) would run the month from receipt on 3 March, with no written pause while the firm waited for clarification. Identity is confirmed from HR records without asking her. Review of 312 messages across two languages takes longer than planned, so the firm tells her on 25 March that it is using the two-month extension, with reasons, and replies on 22 May 2026, inside the extended deadline of 3 June 2026. ## Checklist - [ ] The request is logged with its date of receipt. - [ ] The due date is set in calendar months, not 30 days. - [ ] Identity was checked only where there was reasonable doubt. - [ ] Any clarification request and the reply are dated on the record. - [ ] Every system in the search plan was searched, with terms and dates recorded. - [ ] Each redaction or withheld item has a recorded reason. - [ ] A second person checked the redactions. - [ ] The reply includes the supporting information and how to complain. - [ ] Any extension notice went out within the first month, with reasons. - [ ] The response file is kept with the reply date. ## How Sted helps Sted's knowledge base includes a Data Subject Rights Request Record (REC-DSRR) under the Data Subject Rights Handling Policy (POL-DSR), with ten sections from the request and its identity check, through whether the right applies and the deadline, to what the reply told the person and which recipients were notified. Records are part of the Full Management System plan. Records follow templates with sections and, where useful, structured fields you can report on. Records are part of the Full Management System plan. Records take file attachments, scanned for malware before download. Sted does not answer requests from individuals for you. You search your systems, decide on exemptions and reply, and keep the request's record in Sted. ## Related standards - [Individual rights and subject access requests](/docs/standards/gdpr/individual-rights-and-dsars): all eight rights and the UK clock in full. - [Data (Use and Access) Act 2025 changes](/docs/standards/gdpr/data-use-and-access-act-changes): where Articles 12A and 15(1A) and the complaints duty came from. - [SOC 2 privacy](/docs/standards/soc-2/privacy): the access criteria a SOC 2 privacy report tests. - [Subject access request](/docs/glossary/subject-access-request) and [personal data](/docs/glossary/personal-data): the terms defined. - [Special category data](/docs/glossary/special-category-data): health or other sensitive data found in a search needs extra care before release. - [Records](/docs/product/records): where each request is logged in Sted. ## Frequently asked questions Q: How long do I have to respond to a subject access request in the UK? A: One calendar month from the relevant time, which is the latest of receiving the request, any identity information you asked for, or any fee. A request received on 31 January is due on 28 February, or 29 February in a leap year. You can extend by two further months for complex or numerous requests if you tell the person within the first month. Q: Can I refuse a subject access request? A: Yes, but rarely. You may refuse, or charge a reasonable fee, when a request is manifestly unfounded or excessive, and you must tell the person why and how to complain. A large or awkward request is not excessive on that ground alone, so write down your reasons before you refuse. Q: Do I have to give someone emails that mention them? A: Yes, where the email contains their personal data and a reasonable and proportionate search finds it. You give them their personal data, not necessarily every whole document. Other people's details in the same email may be redacted or released after weighing their interests.