Do I Need A Subject Access Request Policy?

Yes, if your business handles personal data in any meaningful way, a subject access request policy is usually worth having. You may not be legally required to keep a document with that exact title, but you do need a reliable way to recognise, record and respond to requests under the UK GDPR and the Data Protection Act 2018.

The nuance is that SARs are often messy in real life. They can arrive by email, in a staff grievance, over the phone, through a customer complaint, or as a one-line message saying, send me everything you have on me.

A written policy, supported by a simple access request form, gives your team a calm, repeatable process. It helps you avoid missing the one-month deadline, sending too much information, or overlooking emails and HR records that should have been checked.

Do You Legally Need A Subject Access Request Policy?

No, UK data protection law doesn't say every business must have a standalone subject access request policy. However, you do need to be able to comply with the right of access under the UK GDPR, and a policy is one of the simplest ways to show you're taking that obligation seriously.

Under the UK GDPR, individuals have the right to access their personal data. In practice, that means you may need to confirm whether you're processing their data, provide a copy of that data, and give certain information about how you use it.

The Information Commissioner's Office, often called the ICO, expects businesses to have proper processes in place. If something goes wrong, your written procedure and records can help show that you acted reasonably.

A policy is especially useful because SARs can be made:

• In writing, including by email, letter, social media message or web form
• Verbally, including over the phone or in person
• To any member of your team, not just your data protection contact
• Without using the words subject access request or SAR

That last point catches many businesses out. If your receptionist, store manager or HR assistant doesn't know what to look for, the clock may start running before anyone realises a SAR has been made.

UK data law has been updated by the Data (Use and Access) Act 2025, including changes relevant to SAR handling such as reasonable and proportionate searches and pausing the response clock where clarification is reasonably required. It's sensible to review your internal process, privacy policy and related records against current ICO guidance.

When Does A Subject Access Request Policy Become Worth Having?

It becomes worth having as soon as a SAR would take you more than a few minutes to handle confidently. For most SMEs and employers, that point comes earlier than expected.

You should strongly consider a written policy if your business:

• Employs staff, contractors or casual workers
• Keeps HR files, disciplinary records, timesheets, CCTV or workplace messages
• Deals directly with customers, clients, patients, students or members
• Uses a CRM, booking platform, helpdesk, payroll system or marketing database
• Has several people who might receive a request
• Has had disputes, complaints, redundancies, grievances or performance issues

Say Maya runs a 22-person cleaning business in Manchester. A former supervisor emails her saying, I want all information you hold about me, including emails from managers. Maya has one month to respond.

Without a policy, she may not know who should search payroll, HR folders, WhatsApp messages, rota software and manager emails. She may also forget to check whether customer names, complaints from other staff or legally privileged advice need to be removed before sending anything.

With a policy, Maya can follow a set workflow:

• Log the request on the day it arrives
• Confirm identity if needed
• Tell managers to preserve relevant records
• Search the agreed systems
• Review and redact the documents
• Send a clear response pack before the deadline

The policy doesn't make the SAR effortless, but it stops it becoming a panic project.

What Should Your Subject Access Request Procedure Include?

Your subject access request procedure should set out who does what, when they do it, and how decisions are recorded. The aim is to turn a stressful request into a checklist your team can follow.

A practical procedure usually covers these steps.

1. Recognise And Log The Request

Train your team to spot requests that ask for personal data, even if they don't use legal wording. Record the date received, who received it, the requester's details, what they asked for, and the response deadline.

The usual deadline is without undue delay and within one month of receiving the request. If you receive a SAR on 4 March, you should normally respond by 4 April.

2. Check Identity And Scope

If you have reasonable doubts about the requester's identity, ask for information needed to confirm it. Keep this proportionate. For example, you may not need a passport copy from a current employee who writes from their work email.

If the request is very broad or unclear, you can ask for clarification where it's reasonably required to respond. If you do, the response clock pauses from the day you ask and resumes the day after you receive the clarification. Don't ask for clarification on a blanket basis or as a way to delay the request unnecessarily.

3. Search In The Right Places

Your procedure should list the systems you may need to check, such as:

• Email accounts and shared inboxes
• HR and payroll systems
• Customer databases and CRMs
• Project management tools
• Call recordings, CCTV, your CCTV privacy policy and access logs
• Messaging platforms used for work
• Paper files and archived folders

The search should be reasonable and proportionate. You don't need to do the impossible, but you do need to think carefully about where relevant personal data is likely to be held.

4. Review, Redact And Respond

Before sending documents, check whether they include other people's personal data, confidential business information, legal advice, or material that may fall within an exemption under the Data Protection Act 2018.

Your response should explain what you've provided, any searches or limitations, and any information withheld where it's appropriate to say so.

What Should A SAR Policy Template UK Businesses Use Cover?

A SAR policy template should give you a starting structure, but it shouldn't be treated as a finished document. The right process depends on your team, systems, risks and the type of data you hold.

If you're using a template, make sure it covers the following sections and tailor each one carefully before using it.

1. Purpose: State that the policy helps your business respond to subject access requests under the UK GDPR and Data Protection Act 2018.
2. Scope: Explain who the policy applies to, including staff, managers, directors, contractors and any teams that handle personal data.
3. What Counts As A SAR: Give examples of written and verbal requests your team may receive, including informal wording.
4. Roles And Responsibilities: Name the person or role responsible for logging, coordinating, reviewing and approving responses.
5. Deadlines: Record the one-month deadline, when extensions or clarification pauses may be considered, and who can approve them.
6. Identity Checks: Explain when identity checks are needed and what evidence is proportionate.
7. Search Process: List the systems, files and people that may need to be searched.
8. Review And Redaction: Set out how you'll deal with third-party data, confidential information, legal advice and possible exemptions.
9. Response Pack: Describe the documents and explanations that should be included when you reply.
10. Record Keeping: Say what you'll keep on file, including the request, search notes, decisions, redactions and final response.
11. Complaints And Escalation: Explain how the requester can raise concerns with you, and when senior help or legal advice is needed.
12. Training And Review: Set how often staff will be trained and when the policy will be reviewed.

Templates often miss the practical details that matter most, such as where your data actually lives and who can access it. A lawyer can help adapt the document so it matches your business rather than sitting unused in a folder.

How Should Employers Handle A GDPR Subject Access Request?

Employers should handle a GDPR subject access request in the same one-month timeframe, but with extra care around HR records, workplace complaints and other employees' personal data.

Employment SARs often arrive during sensitive moments, such as a grievance, disciplinary process, redundancy consultation, performance review or exit dispute. That doesn't make the SAR invalid. You still need to deal with it separately and calmly.

From an employer's perspective, the tricky part is that employee files rarely contain only one person's data. A manager's email about an employee may also identify colleagues, customers or complainants. A grievance file may include witness statements. CCTV may show several staff members and customers.

Your employer SAR workflow should include:

• Notifying HR or the business owner as soon as the request is received
• Preserving relevant records in line with your data retention policy so nothing is accidentally deleted
• Searching HR, payroll, email, messaging, rota and performance systems
• Separating the SAR process from any grievance or disciplinary process
• Reviewing whether third-party names and details should be redacted
• Checking whether legal professional privilege or another exemption may apply
• Keeping a clear audit trail of decisions

For example, if a former employee asks for all emails mentioning their name, you don't automatically need to send every email in full. You need to identify their personal data, consider the context, remove information they aren't entitled to receive, and explain your response clearly.

ACAS guidance is also useful from an employment management perspective, especially where the SAR overlaps with a workplace dispute. Still, the legal right of access sits under UK data protection law, so your internal SAR process should be led by your data protection obligations.

What Happens If You Miss The Deadline Or Make A Mistake?

If you miss the deadline or make a mistake, act quickly, keep a written record, and fix what you can. A late or incomplete response is much easier to manage if you can show you've taken the issue seriously.

Start with these steps:

1. Check The Timeline: Confirm when the SAR was received, when it was recognised, and what deadline applied.
2. Preserve The Records: Make sure relevant emails, files, chat messages, HR records and system exports aren't deleted.
3. Finish The Search: Complete any outstanding searches and document where you looked.
4. Review Before Sending: Don't rush out unreviewed documents just because you're late. Redaction still matters.
5. Update The Requester: Give a clear update, apologise where appropriate, and explain when you'll respond.
6. Record The Fix: Note what went wrong and what you'll change in your procedure.

You can extend the response period by up to a further two months if the request is complex or you have received a number of requests from the same person. You should tell the requester within the first month if you're extending, and explain why.

In most cases, you can't charge a fee for responding to a SAR. A fee may only be possible in limited situations, such as where a request is manifestly unfounded or excessive, so get advice before relying on that.

If the requester complains to the ICO, your records will matter. A simple SAR log, search notes, redaction decisions and copies of your correspondence can make a big difference. They show that your business had a process, not a last-minute scramble.

Key Takeaways

• A subject access request policy isn't always a legal requirement by name, but it's a practical way to meet your UK GDPR obligations.
• Your policy should help your team recognise SARs, log them, search the right systems, review documents and respond within one month.
• If clarification is reasonably required, the response clock pauses from the day you ask and resumes the day after clarification is received.
• Employers need extra care because HR records often include other people's personal data, workplace complaints and sensitive context.
• A SAR policy template can be useful, but it should be tailored to your systems, team structure and risk profile before you rely on it.
• If something goes wrong, keep records, communicate clearly and fix your workflow so the next request is easier to manage.

If you'd like help with your subject access request policy, your internal SAR workflow, staff training materials or a template response pack, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.