Subject access requests: a routine for small firms

Key takeaways

A subject access request (SAR) is a person's right under UK GDPR to receive a copy of their personal data. You usually have one month to respond, extendable by up to two further months for complex or numerous requests, and you normally cannot charge. The searching, collating and logging repeat for every request, so a written routine keeps you on time.

• 1 month to respond in most cases (ICO).
• Up to 2 more months for complex or numerous requests.
• Usually free of charge.
• Redaction decisions stay with a named person.

How do you recognise a subject access request?

A SAR does not need to use the words 'subject access' or be in writing to a particular person. Any request from someone for their own personal data counts, whether by email, letter, social media or phone. Train front-line staff to recognise one and log it the same day, because the clock starts when it is received.

• How UK SMEs can use outsourcing to handle repetitive tasks
• GDPR and offshore outsourcing

What are the steps in a SAR routine?

Log the request and the deadline, confirm the requester's identity if reasonably necessary, search every system that may hold their data, collate the results, apply any exemptions and redact third-party data, then send the response with the supporting information the ICO lists. Keep a record of what was searched and sent.

• Log the request and calculate the deadline.
• Confirm identity where reasonably needed.
• Search email, CRM, files, phone notes and backups.
• Redact other people's data.
• Send the response and keep a record.

• Single source of truth: one place for each business fact
• Document formatting support: proposals that look right

How long does a SAR take?

In an illustrative example, a SAR from a former customer of a 20-person firm takes about 4 hours to search five systems and collate, plus an hour of review and redaction. A request from a former employee can take much longer because of email volume. These are example figures. A list of systems to search saves the most time.

• Data migration: move systems without losing records

Which parts should stay in-house?

Decisions on exemptions, redaction of sensitive material and any refusal must be made by a named person accountable for data protection, because they need judgement. A support team can log, search and collate under your instructions, as your processor, with access limited to the request.

• Data processing agreements for outsourcing
• Rule-based vs judgement tasks: what to hand over

What does this look like in practice?

A pattern we see: a business misses the deadline on its first SAR because nobody knew where all the data lived. A one-page routine with a systems list makes the second one straightforward.

• See client work
• BPO Solutions for UK businesses

SAR routine checklist

Prepare these before the next request arrives.

• Staff know how to recognise a SAR.
• A log with deadlines.
• A list of every system holding personal data.
• A named person for exemptions and redaction.
• A response template with the required information.

• Data security with an outsourced team

Next step

Tell us which systems hold customer and staff data. We will help you draft a SAR routine and say plainly which steps a support team could take on.