A subject access request rarely arrives labelled as one. It turns up as an email asking for "everything you hold about me", sometimes in the middle of a complaint, sometimes from a former employee. The obligation starts the moment it lands, whoever it lands with.
You have one month to respond. That can be extended by two further months where the request is complex, but the extension has to be communicated within the first month, and "we're busy" is not complexity.
Start with scope, not with searching
The most common failure is a fortnight spent exporting mailboxes before anyone has asked what the person actually wants. A short clarifying reply is permitted, and usually narrows the work considerably.
Clarifying the request is not a delaying tactic. It is the only way to answer it properly.
Keep a note of what you searched, where, and with which terms. If the response is ever challenged, that record is the difference between a defensible process and an argument about memory.
What you can hold back
Less than people assume, and more than nothing:
- Third-party personal data, unless it can be redacted or the third party consents.
- Legally privileged material, and some management-planning information.
- Anything covered by a specific exemption in the Data Protection Act 2018 — each of which needs to be applied deliberately, not as a blanket.
The practical version
Log it the day it arrives. Clarify within a few days. Search once, properly, with a record. Redact with reasons. Send it with a short covering note explaining what you've provided and what you haven't, and why.
Most requests that escalate to the ICO do so because the requester couldn't tell what had been done. Explaining your working is, more often than not, the whole job.
Do you know what process should be followed when a subject access request is received and the best approach to take to respond to one? Our subject access request support page outlines why it's so important to ensure a structured approach is undertaken for individual requests.
Not sure how your organisation would handle a request today? Start with a free data protection review.
