Subject Access Request (SAR) Procedure template

2. Recognising a SAR

• Any request for a copy of someone's own personal data is a SAR: "send me everything you hold on me", "I want a copy of my file", "what information do you have about my account?"
• It does not need to use the words "subject access request", mention UK GDPR, or be in writing — verbal requests count.
• It can arrive by email, letter, phone, social media, review reply, or in person, addressed to anyone.
• Requests can come through a representative, such as a solicitor or family member — check their authority to act before releasing anything.
• If you are unsure whether something is a SAR, pass it to the SAR owner and let them decide.

3. Roles and responsibilities

• SAR owner ([name/role], deputy [name/role]): logs, runs, and signs off every request.
• Managers: pass anything that might be a SAR to the SAR owner the same working day.
• IT and system administrators: run searches across the systems they manage when asked.
• All staff: never ignore, delay, or answer a SAR themselves — route it.

4. Log, acknowledge, and verify

1. 1Forward the request to the SAR owner the same working day it arrives.
2. 2Log the date received — the response deadline is one calendar month from that date, not from when it reached the SAR owner.
3. 3Acknowledge the request and confirm the deadline to the requester.
4. 4Verify identity only if there is genuine doubt, asking for the minimum needed — do not use identity checks to buy time.
5. 5If you genuinely cannot respond without clarifying what the requester wants, ask promptly and check ICO guidance on how clarification affects the deadline.

5. Search

1. 1List every system that could hold the requester's data: [email, HR system, CRM, booking or till system, CCTV, shared drives, messaging tools, paper files].
2. 2Search using their name, known variants, email addresses, and account or payroll numbers.
3. 3Suspend routine deletion for anything in scope while the request is open.
4. 4Gather results into a single secure working folder at [location], access-limited to those handling the request.

6. Review and redact

1. 1Remove or redact other people's personal data unless they consent or it is reasonable to disclose it — take a considered view and record it.
2. 2Consider any exemptions narrowly, and record which were applied and why.
3. 3Check the material is intelligible — explain codes and abbreviations where needed.
4. 4Prepare the supplementary information (purposes, recipients, retention, rights) — usually by enclosing or linking the privacy policy.
5. 5Have the SAR owner review the final bundle before anything is sent.

7. Respond

1. 1Send the response securely — [encrypted file, secure portal, or tracked post] — before the deadline.
2. 2Include a plain-language covering note listing what is enclosed, any redactions or exemptions applied, and how to complain, including to the ICO.
3. 3Record the date sent, the method, and exactly what was provided.

8. Records and review

The SAR log at [system/location] records every request: dates, identity checks, search scope, redaction decisions, and the response. Keep the response bundle for [period] in case of follow-up or complaint.

This procedure is reviewed [frequency, e.g. annually] and after any request that ran late or drew a complaint. Owner: [name/role]. Next review due: [date].