A subject access request (SAR) is a person asking an organisation for a copy of the personal information it holds about them, under UK data protection law. You must respond without undue delay and within one month, usually free of charge, and the request is valid whether it arrives in writing, verbally or through social media.
Most small businesses get their first SAR without realising it's one. It might be a line in a complaint email, a comment on Facebook or a phone call from a former employee. The Information Commissioner's Office (ICO) updated its guide on 16 July 2026 to reflect the Data (Use and Access) Act 2025, so here's what it now says you must do.
How to recognise a subject access request
The ICO says a request is valid if it's clear the person is asking for their own personal information. They don't need to use a particular form of words, mention the law or send it to a specific contact. That means a SAR can land with anyone in your business, which is why staff who handle email, phones and social media need to know what one looks like.
- It can be made verbally or in writing, including via social media.
- A third party, such as a relative, friend or solicitor, can make it on someone's behalf, but it's their job to show they have authority.
- It can come through an online portal acting for the person.
- Requests about children need you to consider whether the child is mature enough to understand their rights.
The deadline and how it can move
| Situation | What the ICO says |
|---|---|
| Standard request | Respond without undue delay and within one month of receipt |
| You need ID, proof of authority or a fee | The month runs from when you receive it |
| Complex request, or several requests from the same person | You can extend by up to two further months, but tell them within the first month and explain why |
| You need clarification | The clock stops the day you ask and restarts the day after they reply |
| Manifestly unfounded or excessive | You can refuse, as an exemption or restriction applies |
Stopping the clock, and its limits
This is the detail many businesses get wrong. If you hold a lot of information about someone, or the request is vague, you may ask them to clarify what they want, and the ICO calls the pause 'stopping the clock'. But you should only ask if it's reasonably required, and the ICO says you can't force someone to narrow the scope of their request. If they simply repeat it, you still have to make a reasonable search.
How far you have to search
The updated guide says you must make a reasonable and proportionate search for the information, but you don't need to run searches that are unreasonable or disproportionate to the importance of the information. In practice, that means checking the places personal data really lives: email, your CRM, HR files, support tickets, call notes and messaging tools, including any AI note-taker that records calls. My piece on the privacy risk of AI meeting notes explains why those transcripts count.
Fees and identity checks
In most cases you can't charge a fee. The ICO allows a reasonable fee for administrative costs in limited cases, such as when a person asks for further copies, and you should explain the costs and ask for the fee as soon as possible. On identity, be reasonable and proportionate: only ask for formal ID if it's necessary, and ask early, because the deadline doesn't start until you receive it.
What you have to send
The person is entitled to a copy of their personal information plus supplementary information, which largely matches what you'd put in a privacy notice. If they asked electronically, you must reply in a commonly used electronic format unless they ask otherwise. You can give secure remote access instead, but only if they can download a copy in a format that works for them, and you must take reasonable steps to send it securely.
A simple SAR process for a small business
- Log the date the request arrived, however it came in.
- Confirm who's asking, and ask for ID or authority only if you need it.
- Decide quickly whether you need clarification, and ask straight away if you do.
- Search every system that holds their data, reasonably and proportionately.
- Check for information about other people and any exemption that might apply.
- Send the copy and supplementary information securely, in an accessible format.
- Keep a record of what you sent and when.
- Review the request afterwards and fix anything that slowed you down, such as data in a tool nobody remembered.
If you sell to UK customers, check you've paid the ICO data protection fee too, and sales teams should read what GDPR means for sales.
My verdict
A SAR isn't something to fear, but it's one of the few data protection jobs with a hard deadline. Train everyone who touches customer contact to recognise one, log the date the moment it arrives, and know where your data lives before the first request does. The month disappears quickly when you're hunting through inboxes.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Frequently asked questions
What is a subject access request?
A request from a person for a copy of the personal information an organisation holds about them, and other supplementary information.
What is the deadline for responding to a SAR?
Without undue delay and within one month of receiving it. You can extend by up to two further months if the request is complex or you've received several from the same person.
Does a SAR have to be in writing?
No. The ICO says a person can make a SAR verbally or in writing, including via social media.
Is there a fee for a subject access request?
In most cases, no. A reasonable fee for administrative costs is allowed only in limited cases, such as requests for further copies.
What does stopping the clock mean?
If you reasonably need clarification, the one-month time limit pauses on the day you ask and resumes the day after you get the answer.
Can I refuse a subject access request?
Only if an exemption or restriction applies, for example if the request is manifestly unfounded or excessive.
Can someone make a SAR for another person?
Yes. A relative, friend or solicitor can make one on someone's behalf, but it's their responsibility to provide evidence that they're authorised to act.
