Do You Need A Subject Access Request Form?

Yes, a subject access request form can be a useful part of your data protection process. It helps you collect the details you need, check identity, find the right records and respond on time.

The slightly trickier part is that you usually can't make someone use your form before you'll deal with their request. Under the UK GDPR and the Data Protection Act 2018, a customer, employee or former employee can make a subject access request in writing, by email, through a message, or even verbally.

So, the aim isn't to create a hurdle. The aim is to make it easy for people to give you helpful information, while giving your business a clear, repeatable process.

Let's go through how an access request form can work in practice, what it should ask for, and how to respond without missing your UK GDPR deadlines.

What Is A Subject Access Request Form?

A subject access request form is a document or online form that helps you collect information from someone who wants access to the personal data your business holds about them.

You'll often hear these requests called:

• Subject access requests
• SARs
• Data subject access requests
• DSARs
• Customer data access requests

They all generally refer to the same right under the UK GDPR: an individual can ask whether you're processing their personal data and request a copy of that data, along with certain information about how you use it.

For your business, the form is there to keep things organised. It can help you ask for:

• The person's name and contact details
• Proof of identity, where needed
• The type of information they're looking for
• The date range or account details that may help you search
• How they would like to receive the response

For example, say Priya runs a small online skincare store. A customer emails, Please send me all the data you have about me. Priya can reply with a short acknowledgement and offer a simple access request form so the customer can confirm their account email, order number range and preferred delivery method. That makes the search much easier, but Priya still needs to treat the original email as a valid request.

Can You Ask Customers To Use A Subject Access Request Form?

Yes, you can ask customers to use your form, but you usually can't insist on it if they've already made a valid request.

This is where many small businesses accidentally create risk. A form is helpful, but it shouldn't become a barrier. If someone says, I want a copy of the personal data you hold about me, that's likely enough to trigger your obligations, even if they don't mention the UK GDPR or use the words subject access request.

You can still send them your form and say something like:

We've received your request. To help us locate the right information and respond securely, please complete the attached form if you're happy to do so. If you prefer not to use the form, please send us the details requested below.

That approach keeps things practical without making the form compulsory.

What If The Request Is Too Vague?

If you genuinely need more information to identify the person or locate the data, you can ask for clarification. For example, if a customer uses several email addresses or has had multiple accounts over several years, it's reasonable to ask which account or period they mean.

Be careful not to ask for extra detail just to slow things down. The Information Commissioner's Office, known as the ICO, expects organisations to help people exercise their rights, not make the process harder than it needs to be.

What Should Your Access Request Form Include?

Your access request form should ask for enough information to process the request, but not so much that it feels intrusive or unnecessary.

A good DSAR form for a UK business will usually include:

• Requester details: full name, contact details and any customer or employee reference number.
• Relationship with your business: for example, customer, employee, former employee, supplier contact or job applicant.
• Details of the request: what information they want, such as account records, emails, order history, HR records or call recordings.
• Time period: the date range they're interested in, if they know it.
• Identity checks: space to request proof of identity where you reasonably need it.
• Authorised representatives: if someone is acting for the individual, ask for written authority to act.
• Preferred response method: for example, email, secure file transfer or post.
• Accessibility needs: any format needs that may help the person access the response.

You don't need to ask for everything every time. If a regular customer contacts you from the same email address attached to their account and only wants their order history, you may not need extra ID. If a former employee asks for HR records from a personal email address you don't recognise, stronger identity checks may be sensible.

Try to avoid asking for sensitive documents unless they're genuinely needed. For example, requesting a passport scan for every simple customer request may be more data than you need. That can create a fresh data protection issue for your business.

Can You Charge A Fee For A Subject Access Request?

Usually, no. Under the UK GDPR, you generally need to respond to a subject access request free of charge.

There are limited situations where you may be able to charge a reasonable fee or refuse to act. This may apply if the request is manifestly unfounded or manifestly excessive, for example because it's clearly abusive or repeats the same request without any reasonable purpose.

Those are narrow exceptions. For most customer and employee requests, the safer working assumption is that you'll respond without charging.

If you're thinking about refusing a request or charging a fee, get advice first. Getting this wrong can lead to complaints to the ICO and can also damage trust with customers or staff.

How Long Do You Have To Respond To A Subject Access Request?

You usually have one month to respond to a subject access request.

The deadline starts when you receive the request. If you need information to confirm the person's identity and you ask for it promptly, the clock may be paused until they provide that information. Don't rely on that casually, though. If you already know who the person is, you should keep moving.

You can extend the response period by a further two months if the request is complex or if the person has made several requests. If you do this, you need to tell the person within one month of receiving the request and explain why the extension is needed.

For a small business, the one-month deadline can come around quickly, especially if the request involves emails, customer support records, HR files and third-party platforms. That's why having a form and internal process helps. It gives you a way to capture the request, assign responsibility and track the deadline from day one.

How Should You Respond To A Subject Access Request?

You should respond clearly, securely and within the UK GDPR timeframe.

Here's a practical process you can adapt for your business.

1. Record The Request

Log the date received, who made the request, what they asked for and the response deadline. If the request came through an unusual channel, such as Instagram messages or a customer support chat, make sure your team knows to escalate it.

2. Acknowledge It

Send a short acknowledgement. Confirm you've received the request, explain any extra information you need, and give a broad idea of when you'll respond.

3. Check Identity Where Needed

Only ask for proof of identity where it's reasonable. The level of checking should match the risk. Sending payroll records to the wrong person is much riskier than sending a copy of basic account information.

4. Search The Right Systems

Think beyond your main customer database. Depending on your business, personal data may sit in:

• Email inboxes
• CRM systems
• eCommerce platforms
• Payment records
• Customer support tools
• Marketing platforms
• HR and payroll systems
• Call recordings
• Spreadsheets and shared drives

This is where an access request form can save time. If the person gives you a date range, account email or order number, your search can be more focused.

5. Review Before Sending

Don't simply export everything and send it across. Review the material first.

You may need to remove or withhold information in some cases, such as:

• Personal data about other people
• Legally privileged communications
• Confidential business information, where disclosure would be inappropriate
• Information covered by a specific exemption under the Data Protection Act 2018

Redactions need care. If a document includes comments about several employees or customers, you may need to disclose the requester's personal data while protecting others.

6. Send The Response Securely

Use a secure method that fits the sensitivity of the data. For low-risk information, email may be fine. For HR files, financial data or special category data, consider password protection or a secure file transfer process.

Your response should usually include a copy of the personal data and information such as why you use it, who you share it with, how long you keep it and the person's rights. Your privacy notice may already cover some of this, but the response should still be clear enough for the request in front of you.

Can Employees Make Subject Access Requests Too?

Yes, employees, workers, former employees and job applicants can make subject access requests.

From an employer's perspective, employee DSARs can be more complex than customer requests because they may involve emails, performance notes, disciplinary records, grievance files, CCTV, payroll information and messages between managers.

A subject access request doesn't automatically mean you must hand over every workplace document that mentions the person. The right is to access their personal data, subject to relevant exemptions and the rights of other people.

For example, if a former employee asks for everything you've ever written about me, you may need to search HR files and relevant emails. But you may also need to redact comments that identify other employees, consider legal privilege and decide whether any exemptions apply.

You also need to be careful not to treat a DSAR as a workplace conflict tactic and ignore it. Even if the request arrives during a grievance, redundancy process or settlement discussion, it still needs to be handled under data protection law. ACAS guidance may also be relevant for managing the employment issue fairly, but it doesn't replace your UK GDPR obligations.

Common Mistakes To Avoid

The main mistake is treating your access request form as the only valid way to make a request.

Here are a few other issues to watch for:

• Missing informal requests: your frontline staff may not recognise a DSAR if it doesn't use legal wording.
• Asking for too much ID: identity checks should be proportionate to the risk.
• Letting the deadline drift: one month isn't long if you need to search several systems.
• Sending third-party data: you may need to redact personal data about other people.
• Forgetting processors: if a software provider stores personal data for you, your contract should help you retrieve it quickly.
• Using a generic template without adapting it: templates can be a useful starting point, but your form and response process should match how your business actually collects and stores data.

It also helps to train anyone who handles customer or employee messages. They don't need to become data protection experts, but they should know that phrases like send me my data, what information do you hold about me or I want a copy of my file may need to be escalated.

How Do You Set Up A Simple DSAR Process?

You can set up a simple DSAR process by combining a clear form, an internal checklist and assigned responsibility.

For many small businesses, the process can be straightforward:

1. Create an access request form for your business that asks for the key details without going overboard.
2. Add a short internal checklist for logging, identity checks, searches, review, redactions and response.
3. Nominate one person or role to manage requests, even if others help with searches.
4. Keep a DSAR register showing dates, decisions, extensions and response methods.
5. Check your contracts with key software providers so they support you with data requests.
6. Review your privacy notice so it explains how people can exercise their rights.

If you receive very few requests, this may only take a light-touch process. If you handle large volumes of customer data, health information, financial information or employee records, you'll likely need a more detailed workflow.

The key is to make the process easy to use. If your staff can follow it under pressure, you're much less likely to miss deadlines or send the wrong information.

Key Takeaways

• A subject access request form can help your business collect the right details, but you usually can't force someone to use it.
• Customers, employees, former employees and job applicants can make DSARs under the UK GDPR and Data Protection Act 2018.
• You usually need to respond within one month, with a possible two-month extension for complex or multiple requests.
• Identity checks should be reasonable and proportionate, not automatic or excessive.
• Review and redact information before sending it, especially where other people's personal data is involved.
• A simple form, register and internal checklist can make DSARs much easier to manage.

If you'd like help with your subject access request forms, privacy processes, employee data requests or customer data compliance, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.