What this review helps you do
A subject access workflow should connect the request to a recorded search plan, an information-review process and secure delivery. Keep the actual deadline visible, explain any justified limits or extensions, and retain evidence of the searches and disclosure decisions made.
AT A GLANCE
Follow a request from first contact to secure disclosure, with a defensible search, proportionate identity checks and a clear exemption record.
The legal position
Recognise requests through any channel, including verbal requests and social messages. Respond without undue delay and normally within one month; a further two months may be available for the complexity or number of requests from the same individual, where necessary, with timely reasons.
Make reasonable and proportionate searches and record any limits. Asking for clarification pauses the clock only where clarification is reasonably required about the requested information; it is not a blanket delay mechanism or a means to force narrowing.
Use a proportionate identity check. Requests are normally free; the exceptions include manifestly unfounded or excessive requests and additional copies.
Assess exemptions item by item. General-processing third-party data uses DPA Schedule 2 paragraph 16: consider consent or whether disclosure without consent is reasonable. Legal privilege, negotiations and management forecasting have separate conditions.
Health data requires the Schedule 3 safeguards, including the serious-harm assessment and appropriate health professional involvement where applicable.
What to review
- Audit recognition, receipt records, authority for representatives and deadline calculation.
- Map custodians and systems: business email, shared drives, case systems, messaging, archives and work information on personal devices.
- Document search terms, systems searched, omitted repositories and proportionality reasoning.
- Test redaction, metadata removal, third-party decisions, privilege review and secure delivery.
- Review sample employee or client requests for completeness and evidence of decisions.
Working outputs
- SAR workflow and request log
- Search-plan and disclosure-review templates
- Redaction and exemptions decision checklist
- Staff recognition briefing and sample-file findings
PUT THIS GUIDE TO WORK
Review it. Record it. Keep the evidence.
Open the relevant assessment area or complete the matching working document.
Evidence checklist
Use these checks to gather references and identify the evidence that still needs testing.
- Can any staff member identify and route a request?
- Does our log track identity, clarification, extensions and the actual deadline?
- Can we evidence a reasonable and proportionate search?
- Are withholding and redaction decisions individually justified?
- Has someone checked the final disclosure and delivery route?
Implementation tip
Treat search, review and delivery as separate recorded stages. When a dispute is active, preserve relevant material and do not delete it to avoid disclosure.
Apply the limits carefully
A template cannot decide privilege, third-party disclosure or health-related harm. It records the issues for a competent reviewer.
Common misunderstandings
For general UK GDPR processing, the third-party information test is in DPA Schedule 2 paragraph 16. DPA section 94 belongs to the separate intelligence-services regime in Part 4.
One month means a calendar month, rather than a fixed 30 days. Calculate the deadline using the applicable rules and record any permitted adjustment.
Seeking clarification does not suspend supplementary information that can reasonably be provided independently. The pause must satisfy the relevant conditions and be recorded accurately.
The DUAA time-limit amendments commenced on 5 February 2026, with transitional rules for earlier requests. Section 78 on reasonable and proportionate searches commenced on 19 June 2025, and treats its amendments as having taken effect on 1 January 2024. These changes do not all share one commencement date.
Worked example: checking a worker's search scope
Illustrative scenario. This is a fictional teaching example, not a client case, professional finding or verified outcome.
A fictional former worker requests personal information about a performance process. The organisation initially searches its HR application but has not yet considered related business messages.
- Control
A reasonable and proportionate search should consider the relevant information and locations, with any limits explained and recorded.
- Evidence
Keep the request, relevant dates, custodians, system list, search terms, results and the reasons for any exclusions.
- Finding
The initial plan omits the manager's business email and messages where the performance process was discussed.
- Owner and action
The request lead revisits the scope and coordinates appropriate searches. A competent reviewer assesses third-party information, exemptions, redactions and the response deadline.
- Verification
Check the final disclosure against the search and review logs, test secure delivery and retain evidence of what was sent and when.
Practical questions
Can the search log contain information withheld from the requester?
The internal log may record review decisions, including restrictions and their reasons. Apply suitable access and retention controls to that log, and separately consider what information the response must provide.
Should we narrow every broad request?
Clarification must be reasonably required, not a routine condition of responding. Record the reason for asking and follow the applicable timing rules; consider information that can reasonably be provided without that clarification.
Official sources
- ICO: A guide to subject access (opens in a new tab)
- ICO: Responding to a request and clarification (opens in a new tab)
- ICO: Finding and retrieving information (opens in a new tab)
- ICO: Third-party information in SARs (opens in a new tab)
- ICO: Data protection exemptions, including health data (opens in a new tab)
- DPA Schedule 2 paragraph 16 (opens in a new tab)
- DUAA section 78: proportionate searches and retrospective effect (opens in a new tab)
Source-linked editorial review: 1 November 2026. Guidance supports a documented process. It does not replace advice about your particular circumstances or verify your organisation’s compliance.
Content update — 2 November 2026: added an illustrative evidence record, practical questions and related guidance. The existing legal-source baseline is 1 November 2026.