GDPR.ME.UK · WORKING DOCUMENT 75
SAR search, redaction and disclosure decision record
Use this record from initial receipt to final response. A request can arrive verbally or through any normal contact channel. Keep a reasoned, proportionate search and disclosure record.
Document edition 2 · 1 November 2026 · Adapt to your processing and evidence. Use references rather than personal records.
Record details
1. Recognise and log the request
- Record the request as received, channel, date and person handling it. Check authority if made by a representative.
- Request only identity information reasonably needed and do so promptly. Do not require formal identification automatically.
- Compute the applicable calendar-month deadline and record the basis. A month is not a fixed 30 days.
2. Manage clarification and extensions
- Seek clarification only where reasonably required about the information requested. Record why and ask promptly; do not force the person to narrow a valid request.
- Record the pause start and response date and calculate resumption under current rules. Continue providing supplementary information that can reasonably be provided independently.
- If an extension is necessary for complexity or multiple requests, document the reasons and communicate the extension within the applicable period.
3. Plan and record reasonable searches
- Identify custodians, date ranges, identifiers and relevant repositories: email, shared drives, case systems, business messaging, archives and work information on personal equipment.
- Record searches performed, results and technical limitations. Explain any search considered unreasonable or disproportionate with reference to the request and the importance of access.
- Search the remaining in-scope information even when one source cannot reasonably be searched. Preserve relevant material; do not delete it to evade access.
4. Review exemptions and third-party information
- Identify the exact exemption or restriction, the information affected and the facts supporting it. Avoid withholding whole files because one passage is protected.
- For third-party information apply Schedule 2 paragraph 16: consider consent or whether disclosure without consent is reasonable; record relevant confidentiality and other circumstances.
- For health data apply Schedule 3 safeguards, including appropriate health professional involvement where required. Privilege and other exemptions need their own assessment.
5. Prepare and check the disclosure
- Provide the personal information and applicable supplementary information in a clear, accessible form and the appropriate format.
- Verify that redactions are irreversible, hidden content and metadata are considered, the correct person receives the information and the transfer route is secure.
- Explain withheld information, applicable complaint rights and relevant reasons to the extent required and permitted. Record any lawful fee or refusal decision separately.
6. Close and improve
- Record whether the actual deadline was met and any continuing issue or complaint.
- Protect the SAR file and apply a reasoned retention period.
- Use recurring search or redaction problems to improve information management and staff training.
Sources and completion
- ICO: A guide to subject access (opens in a new tab)
- ICO: Clarification and response timing (opens in a new tab)
- ICO: Third-party information in SARs (opens in a new tab)
- ICO: Data protection exemptions (opens in a new tab)
Record who reviewed and approved the document. Save a working copy to reopen it later, or export the completed HTML record. Your entries stay in this page; automatic storage is not enabled. A downloaded record may contain sensitive operational information.
The template does not verify facts, perform an audit, submit a notification or execute a contract.