YOUR WORKING OUTCOME
Recognise each right, calculate the correct timetable, search and review, then explain the decision clearly.
Set the scope
The request is in an ordinary mailbox rather than a dedicated privacy inbox. It contains an access request and an erasure request, which need separate consideration.
The example
Illustrative scenario: a former worker emails a manager asking for a copy of their records and deletion of information no longer needed. The example does not decide a real request or exemption.
First actions
- Record the request as received and route it to the responsible person promptly.
- Identify each right requested and proportionate identity or representative checks.
- Preserve relevant material while the access and retention decisions are assessed; do not delete information to avoid providing access.
Follow the workflow
Recognise and separate the requests
Log the date, channel, wording and responsible handler. Identify access, erasure or other rights without insisting on legal terminology. Keep the requester's actual scope; ask for clarification only where needed.
Evidence: Original request, acknowledgement and a rights log.Your output: Separate decision tracks linked to one request record.What useful evidence might look like
Illustrative: REQ-11 contains an access track and an erasure track with separate outcomes.
ICO: guide to subject access (opens in a new tab) · ICO: right to erasure (opens in a new tab)
Verify identity and calculate time properly
Use identity checks proportionate to any doubt. For access, record the normal calendar-month deadline and any applicable identity, clarification or extension rules. A further two months is available only where necessary because of complexity or the number of requests from the same person, with the required explanation.
Evidence: Receipt and identity dates, scope clarification and any extension reasons.Your output: A checked deadline record and communications log.What useful evidence might look like
Illustrative: the handler records the precise clarification question and why it was reasonably required.
ICO: guide to subject access (opens in a new tab) · ICO: responding to a request, clarification and extensions (opens in a new tab)
Plan and record the search
Identify relevant custodians, identifiers, dates and repositories, including business messages and accessible archives. Conduct reasonable and proportionate searches, recording what was searched and the reasons for any limits. Continue searching other sources where one source poses a difficulty.
Evidence: Search plan, queries, results and proportionality reasoning.Your output: A search record that another reviewer can understand.What useful evidence might look like
Illustrative: SEARCH-11 logs payroll, HR case notes and the relevant business mailbox separately.
Review disclosure and erasure on their conditions
Review the access material for third-party information and applicable exemptions using item-level reasons. Assess the erasure request against continuing purposes and applicable conditions, including legal retention duties or legal-claims grounds where relevant. Do not assume every record must be disclosed unredacted or deleted.
Evidence: Redaction decisions, supporting advice and record-specific retention reasoning.Your output: A disclosure decision and a separately explained erasure outcome.What useful evidence might look like
Illustrative: one record is retained for a documented obligation while an unnecessary duplicate is assigned for deletion.
ICO: third-party information in a subject access request (opens in a new tab) · ICO: data protection exemptions (opens in a new tab) · ICO: right to erasure (opens in a new tab)
Check and deliver the response
Provide the access information and applicable supplementary details clearly and securely. Verify the recipient, redactions, hidden material and format. Explain the separate outcomes, relevant reasons and complaint routes, applying any lawful limits on explanation.
Evidence: Approved response, quality-check record and secure delivery evidence.Your output: A complete response package with a traceable sending record.What useful evidence might look like
Illustrative: a second reviewer tests that a redacted PDF cannot reveal the removed text.
ICO: guide to subject access (opens in a new tab) · ICO: third-party information in a subject access request (opens in a new tab) · ICO: right to erasure (opens in a new tab)
Implement and close the decisions
Complete agreed corrections, restrictions or deletion actions and relevant supplier follow-up. Record remaining questions or complaints. Apply a justified retention policy to the request file and turn recurring retrieval problems into improvement actions.
Evidence: Action completion evidence, response log and review notes.Your output: A closed request record with the actual decisions and evidence.What useful evidence might look like
Illustrative: REQ-11 links the response to the completed supplier-deletion ticket rather than merely promising deletion.
ICO: right to erasure (opens in a new tab) · ICO: accountability and governance (opens in a new tab)
Decision checkpoints
Is identity or authority genuinely uncertain?
If yes: Request only the information reasonably needed and record the reason promptly.
If no: Proceed without an unnecessary formal-ID hurdle.
If uncertain: Have the responsible handler review the existing relationship and risk before asking for more data.
Does the request include information about other people?
If yes: Apply the relevant rights-of-others test and record the disclosure or redaction reasoning.
If no: Continue checking other applicable requirements and exemptions.
If uncertain: Refer the specific information for review; do not withhold the whole file by default.
Is continuing retention necessary under an applicable ground?
If yes: Document the particular records, ground and limits and explain the erasure decision appropriately.
If no: Arrange the required erasure and related follow-up, keeping proportionate evidence.
If uncertain: Resolve the purpose and legal basis with a competent reviewer; a blanket archive hold is not an answer.
Keep the closing record
- Original request and rights identified
- Identity, timing and communication log
- Search plan and actual results
- Item-level disclosure and exemption decisions
- Separate erasure/retention decision
- Secure response and completed follow-up actions
Escalation and limits
- Escalate approaching deadlines, unclear privilege or serious-harm questions promptly.
- A dispute with the requester does not itself justify refusal or a delay.
- The clarification pause for an access request is conditional; it does not automatically suspend every related obligation.
- A SAR worksheet covers access handling. Apply the correct conditions to other rights instead of assuming every right follows an identical decision test.
Official sources
- ICO: guide to subject access (opens in a new tab)
- ICO: responding to a request, clarification and extensions (opens in a new tab)
- ICO: third-party information in a subject access request (opens in a new tab)
- ICO: data protection exemptions (opens in a new tab)
- ICO: right to erasure (opens in a new tab)
- ICO: accountability and governance (opens in a new tab)