# SAR search, redaction and disclosure decision record

Use this record from initial receipt to final response. A request can arrive verbally or through any normal contact channel. Keep a reasoned, proportionate search and disclosure record.

Document edition 2 — 1 November 2026

Organisation / activity: 
Owner: 
Reference and version: 
Review date: 

## 1. Recognise and log the request

- Record the request as received, channel, date and person handling it. Check authority if made by a representative.
- Request only identity information reasonably needed and do so promptly. Do not require formal identification automatically.
- Compute the applicable calendar-month deadline and record the basis. A month is not a fixed 30 days.

Request ID / receipt date / channel: 
Request wording and scope: 
Requester or representative authority: 
Identity check required and reasons: 
Information requested / received dates: 
Initial deadline and calculation basis: 

## 2. Manage clarification and extensions

- Seek clarification only where reasonably required about the information requested. Record why and ask promptly; do not force the person to narrow a valid request.
- Record the pause start and response date and calculate resumption under current rules. Continue providing supplementary information that can reasonably be provided independently.
- If an extension is necessary for complexity or multiple requests, document the reasons and communicate the extension within the applicable period.

Clarification question and necessity: 
Request / response dates and clock adjustment: 
Supplementary information still due: 
Extension reason and length: 
Notification to requester and date: 
Revised deadline and reviewer check: 

## 3. Plan and record reasonable searches

- Identify custodians, date ranges, identifiers and relevant repositories: email, shared drives, case systems, business messaging, archives and work information on personal equipment.
- Record searches performed, results and technical limitations. Explain any search considered unreasonable or disproportionate with reference to the request and the importance of access.
- Search the remaining in-scope information even when one source cannot reasonably be searched. Preserve relevant material; do not delete it to evade access.

Custodian / repository / date range: 
Search terms and identifiers: 
Search operator / date / result: 
Archives / backups / personal-device assessment: 
Omitted search and proportionality reasons: 
Preservation instructions and evidence: 

## 4. Review exemptions and third-party information

- Identify the exact exemption or restriction, the information affected and the facts supporting it. Avoid withholding whole files because one passage is protected.
- For third-party information apply Schedule 2 paragraph 16: consider consent or whether disclosure without consent is reasonable; record relevant confidentiality and other circumstances.
- For health data apply Schedule 3 safeguards, including appropriate health professional involvement where required. Privilege and other exemptions need their own assessment.

Document / passage / information reference: 
Exemption or restriction provision: 
Evidence and reasons for application: 
Third-party consent or reasonableness assessment: 
Health professional / specialist advice where required: 
Reviewer and final disclose / redact / withhold decision: 

## 5. Prepare and check the disclosure

- Provide the personal information and applicable supplementary information in a clear, accessible form and the appropriate format.
- Verify that redactions are irreversible, hidden content and metadata are considered, the correct person receives the information and the transfer route is secure.
- Explain withheld information, applicable complaint rights and relevant reasons to the extent required and permitted. Record any lawful fee or refusal decision separately.

Disclosure package and version: 
Redaction / metadata / quality-check result: 
Supplementary information checklist: 
Response reasons and rights information: 
Recipient verification and secure delivery method: 
Sent date and delivery evidence: 

## 6. Close and improve

- Record whether the actual deadline was met and any continuing issue or complaint.
- Protect the SAR file and apply a reasoned retention period.
- Use recurring search or redaction problems to improve information management and staff training.

Final deadline / response date / outcome: 
Outstanding query or complaint: 
Closure reviewer and date: 
File access and retention: 
Lessons and corrective action: 
Owner and completion evidence: 

## Sources

- ICO: A guide to subject access: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/
- ICO: Clarification and response timing: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/
- ICO: Third-party information in SARs: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/when-can-an-exemption-apply-to-information-about-other-people-in-a-sar/
- ICO: Data protection exemptions: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/exemptions/a-guide-to-the-data-protection-exemptions/