Subject access request policy

The right of access, and why the policy matters

A subject access request (SAR), sometimes called a data subject access request (DSAR), is a person's request, under Article 15 of the UK General Data Protection Regulation (UK GDPR), for a copy of the personal data an organisation holds about them, and the organisation must usually answer free of charge, without undue delay and within one month at the latest. A person, the data subject, is entitled to confirmation of whether or not the organisation is processing their personal data, a copy of that data, and supplementary information about the processing; the ICO says that even if you hold no information about the person, you must respond and tell them so. The exemptions sit in the Data Protection Act 2018. Both have been amended by the Data (Use and Access) Act 2025, whose data protection changes were brought into force in stages; the ICO's page on the Data (Use and Access) Act 2025 says all of them are now in force. One of them changed the regulator: since 30 September 2026 the Information Commission has taken over from the Information Commissioner, under the Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026, so the UK GDPR now speaks of a complaint "to the Commission". The regulator is still known as the ICO, and this guide uses that name.

The law does not require a document called a subject access request policy. It does require the organisation, as data controller, to comply and to be able to show how it complies, and for anything larger than a very small charity that means writing the procedure down. The ICO's guidance on preparing for a subject access request is effectively a checklist for one. Maintained schools and academies, as public authorities, must appoint a data protection officer, and the policy should name that role; charities and care providers must also appoint one where Article 37 requires it, for example where their core activities consist of processing special category data, such as health data, on a large scale, and those that have not appointed one should name whoever leads on data protection.

A subject access request policy usually sits alongside the data protection policy and the retention schedule, and is written using clear and plain language, because it is read by staff who will receive requests and often published for the people who make them.

What the policy should cover

A useful subject access request procedure answers each of these for your organisation, by role rather than by name so it survives staff changes:

1. Scope. Who can make a request (staff, former staff, volunteers, pupils, parents, residents, families, donors, anyone), and that it covers all personal data held, in every system: files, email, databases, CCTV, and work messages wherever they are held.
2. Recognising a request. A request can be made verbally or in writing, including via social media, to any member of staff, and does not have to mention "subject access" or the law. A verbal request is as valid as a written one; write it down and, if you can, confirm it back to the individual making the request. You may offer a subject access request form, but a request is valid without one. The ICO's page on recognising a request is worth giving to every receptionist and team leader.
3. Logging and passing on. The date of receipt, the date any proof of identity, proof of a representative's authority or fee asked for arrives, and who it goes to, the same day.
4. Identity and authority. When to ask for proof of identity, and what is proportionate; how to check that someone requesting on another's behalf, a solicitor or a relative, is authorised.
5. Clarification. When asking the requester what they want is reasonably required, and how the pause in the clock is recorded.
6. Searching. Which systems are searched, by whom, and how the organisation decides what is reasonable and proportionate.
7. Exemptions and third parties. Who decides whether information is withheld, and how the reasons are recorded.
8. The response. What is sent, in what format, how securely, and who signs it off.
9. Refusals, fees and extensions. When a request may be treated as manifestly unfounded or excessive, and who decides.
10. Complaints. How the person can complain to the organisation and to the ICO.
11. Records and review. The SAR log, how long response files are kept, and when the policy is reviewed.

A subject access request form makes requests easier to recognise and to answer, and the ICO’s guidance on recognising a request encourages one: “Standard forms can make it easier for you to recognise a SAR and for people to include all the details you might need to locate their information.” The form must stay optional – “you should make it clear that using the form or online system is not compulsory” – so a request that arrives by letter, email, phone or social media is handled in the same way. A useful form asks for what the ICO suggests people include in a request: name and any previous names; contact details; a reference that helps find the information, such as a staff, pupil or resident number; what information, or which period, they want; how they would like to receive it; and, where someone is asking for another person, their authority, such as written permission or a power of attorney. It may say that a reason helps the search, but it cannot require one.

Schools should add two things that apply only to them: a pupil's own right of access, and the separate right of a parent to see their child's educational record, covered in sections 03 and 05.

Responding to a subject access request, step by step

The ICO's guidance on what to consider when responding to a request sets out the timings. In order:

1. Log the date of receipt. Since 5 February 2026 the time limit has been set by Article 12A of UK GDPR, inserted by section 76 of the Data (Use and Access) Act 2025: one month "beginning with the relevant time", which is the latest of when the organisation "receives the request in question", when it receives any information it asked for to confirm the requester's identity, and when any fee it charged is paid. Article 12(3) requires the response "without undue delay and in any event before the end of the applicable time period", so one month is the most the law allows, not a target. The ICO's guidance goes slightly further than the Article: you "must comply with a SAR without undue delay and at the latest within one month of receipt of the request or within one month of receipt of" the identity information, the proof that a third party is authorised to act, or a fee, that you asked for. Proof of authority is the ICO's addition, so treat it as the ICO's position rather than the Article's. The ICO counts to the end of the same date in the following month (or the last day of that month, if it is shorter), moving to the next working day if that falls on a weekend or bank holiday. Because Article 12A counts the month as "beginning with" the relevant time, so that day is itself the first day of the month, the cautious course is to respond by the day before that date; the ICO itself says you could adopt a 28-day period "to ensure that you always comply within a calendar month". Our SAR and FOI deadline calculator works out both dates.
2. Check the identity of the data subject if you need to. The ICO says to be "reasonable and proportionate about what you ask for"; a member of staff emailing from their work account rarely needs to send a passport. Where you have reasonable doubts about who is asking, Article 12(6) of UK GDPR now lets you "delay dealing with the request until the identity is confirmed", and the month does not start until you have the identity information you asked for. The ICO's guidance also starts the clock only when you receive information you asked for to confirm that a third party is authorised to act; Article 12A itself mentions only identity and fees.
3. Clarify only where it is reasonably required. Article 12A(5) lets you ask for further information where you reasonably require it "in order to identify the information or processing activities to which a request under Article 15 relates", and the days from asking to receiving it do not count towards the time limit (including any extension) or towards the deadline for an extension notice; its example is a controller that "processes a large amount of information concerning the data subject". The ICO's guidance says that when you ask for clarification "the time limit pauses on the day you request clarification and resumes on the day after you receive it". The pause applies only to clarification about the information requested, not, for example, about the format of the response. It is not to be used on a blanket basis, and you should ask as soon as possible after the request arrives. If you can reasonably provide any of the supplementary information without clarification, the ICO says "you must provide it within one month of receipt of the request"; and if the person repeats the request or refuses to narrow it, "you should still comply with their request by making reasonable searches".
4. Search. "You must make a reasonable and proportionate search to respond to a SAR." The ICO's page on finding and retrieving the information lists what bears on that: "the circumstances of the request; the volume of information you may need to search in order to respond; any difficulties involved in finding the information; and the fundamental nature of the right of access." The statute now says the same: Article 15(1A) provides that the person "is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search", and section 78 of the Data (Use and Access) Act 2025, which inserted it, says its amendments "are to be treated as having come into force on 1 January 2024". Record what you searched for the information requested, and why you stopped where you did.
5. Decide on extension early. If the request is complex, or the person has made a number of requests, you may extend by two further months where that is necessary, which the ICO says you calculate "as three months from the original start date". You "must let the person know that you are extending the time limit and explain your reasons why", and Article 12A(4) requires the notice to be given "before the end of the period of one month beginning with the relevant time" and to state the reasons, so a notice sent after that month has ended cannot extend the deadline; decide early. Any days paused for clarification count towards neither period.
6. Apply exemptions item by item, and redact other people's information where required (section 04).
7. Send the response. The personal data, and the supplementary information Article 15 requires: the purposes of processing, the categories of data, the recipients, the retention period or how it is decided, the rights to rectification, erasure, restriction and objection, the right to complain to your organisation (since 19 June 2026, Article 15(1)(ea): "the right to make a complaint to the controller under section 164A of the 2018 Act") and to the regulator (since 30 September 2026, Article 15(1)(f) has read "the right to make a complaint to the Commission under section 165 of the 2018 Act"), the source of the data if not from the person, any automated decision-making subject to safeguards under Article 22C, with meaningful information about the logic involved and its significance and envisaged consequences, and, where data is transferred to a third country or international organisation in reliance on Article 46, the safeguards for the transfer. If the request was made electronically, provide the information in a commonly used electronic form unless the person asks otherwise.
8. Close the log entry with what was sent, what was withheld and why, and the date.

On fees, the ICO's position is short: "In most cases, you cannot charge a fee." A reasonable fee for administrative costs is possible only where a request is manifestly unfounded or excessive, or for further copies.

Schools. Personal data about a pupil belongs to the pupil, and the ICO's education information guidance says "it is the pupil's right to make a SAR"; a parent can make one on the child's behalf if the child is not competent to act for themselves or has consented, and the ICO's guidance on recognising a request, last updated on 7 April 2026, says you could also let a person with parental responsibility act for a competent child "if it’s clearly in the child’s best interests". In Scotland a child aged 12 or over is usually considered mature enough unless there is evidence otherwise; elsewhere competence depends on the child's understanding, though the ICO calls the Scottish age "a good guide to help you decide". Before letting a parent act, consider any court orders about parental access or responsibility, any duty of confidence owed to the child, and the consequences of disclosure, particularly where there have been allegations of abuse or ill treatment. Separately, in maintained schools in England (other than nursery schools) and non-maintained special schools, a parent has a right under the Education (Pupil Information) (England) Regulations 2005 to see their child's educational record within 15 school days of receipt of the parent's written request (section 05). The two rights run on different clocks, and the policy should say which one a parent's request is being handled under.

Subject access request exemptions, and when you can refuse

The exemptions are in Schedules 2 to 4 of the Data Protection Act 2018, and the ICO's page on exemptions relevant to SARs describes each. The governing rule is that "You cannot routinely rely on exemptions or apply them in a blanket fashion." The same page says you should consider whether an exemption applies on a case-by-case basis, and document your reasons for relying on one. Where an exemption applies, it applies to specific personal information, for a reason you can write down, and the rest of the response still goes out. Those that most often arise in schools, charities and care are:

• Information about other people (third parties). You need not disclose information that would identify someone else unless they consent or it is reasonable to disclose it without their consent. This is the exemption that does most of the work in email chains and message threads; our guide to subject access requests and WhatsApp messages walks through the ICO's three-step test and how to redact a group chat.
• Legal professional privilege. Advice from your solicitor about the requester, and documents prepared for litigation.
• Confidential references. A reference given in confidence about the person's employment, education or volunteering.
• Management information. Management forecasting or planning, such as a proposed restructure, to the extent disclosure would prejudice the business.
• Negotiations with the requester. A record of your intentions in negotiations with that person, such as a settlement position, to the extent disclosure would prejudice them.
• Crime. Where disclosure would be likely to prejudice the prevention or detection of crime, for example while the police are investigating.
• Serious harm: education, health and social work data. Where complying "would likely cause serious harm to the physical or mental health of any person", with specific conditions for each kind of data, including when a health professional must be consulted. For health data there is also a restriction: a controller that is not a health professional must not disclose it unless it is satisfied that the person has already seen or knows about it, or it has obtained an opinion from the appropriate health professional, within the last six months, that the serious harm test is not met, and it must re-consult if that would be reasonable; if no opinion can be obtained in time, the ICO says "you must withhold the health information".
• Child abuse data. Where a request is made on a child's behalf by someone with parental responsibility and disclosure would not be in the child's best interests. It can apply only in England, Wales and Northern Ireland, not in Scotland.
• Exam scripts and marks. Candidates have no right to a copy of their exam answers, and there are special rules on the timing of marks.

Separately from the exemptions, you may refuse a request, or charge a reasonable fee, if it is manifestly unfounded or excessive. The ICO says "there is a high threshold" for this, that you need "strong justifications that can be clearly explained to the person", and that "The purpose behind a request is not relevant in considering whether a request is valid". A request made in the middle of a grievance or a dispute is not manifestly unfounded for that reason alone. Article 12(5) puts the burden on the organisation: it "shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request".

If you decide not to act on a request, Article 12(4) of UK GDPR requires you to tell the person, "without undue delay, and in any event before the end of the applicable time period", "of the reasons for not taking action and on the possibility of making a complaint to the controller under section 164A of the 2018 Act, making a complaint to the Commission under section 165 of that Act and seeking a judicial remedy". The complaint to the controller was added on 19 June 2026 and "the Commission" on 30 September 2026, so a refusal template drafted before 19 June 2026 needs both changes, and one drafted before 30 September 2026 needs the second. Where an exemption means you withhold part of the information, it is good practice to give the same explanation for that part. The complaint to the controller is the route section 164A of the Data Protection Act 2018 has required since 19 June 2026: the organisation must make complaining easy, for example with "a complaint form which can be completed electronically and by other means", acknowledge a complaint "within the period of 30 days beginning when the complaint is received" and, "without undue delay", respond to it and tell the complainant the outcome. The subject access request policy should point to that procedure rather than duplicate it.

Two requests that are not subject access requests: a parent’s educational record request, and the records of someone who has died

A parent’s request for their child’s educational record is a separate right from a subject access request, and in England it applies only to maintained schools other than nursery schools, and to non-maintained special schools. Under regulation 5 of the Education (Pupil Information) (England) Regulations 2005, the governing body “shall make a pupil's educational record available for inspection by the parent, free of charge, within fifteen school days of receipt of the parent's written request”, and must provide a copy within the same fifteen school days “on payment of such fee (not exceeding the cost of supply), if any, as the governing body may prescribe”. The regulation applies to “any school maintained by a local education authority (other than a nursery school) and any special school not so maintained”, and the ICO’s education information guidance says that in England and Wales the right “only applies to maintained schools”; academies and free schools are not maintained schools, so a parent there has the subject access route only.

The two routes differ in ways a school’s policy should spell out. The educational record right is the parent’s own; a subject access request is the pupil’s, and a parent can make one for the child if the child is not competent to act on their own behalf or has consented, and the ICO’s guidance on recognising a request says the organisation could also let a parent act for a competent child where that is clearly in the child’s best interests. The regulations reach only the educational record, while a subject access request reaches all the pupil’s personal data. The clocks differ: 15 school days from receipt of the parent’s written request, against one month from receipt of the subject access request (or from the later receipt of proof of identity or a fee asked for). And so do the charges: inspection free and a copy at no more than the cost of supply, against no fee in most cases for a subject access request. What a parent may see under the regulations is limited by the pupil’s own position: the governing body must not disclose information “which they could not lawfully disclose to the pupil himself” under UK GDPR, or to which the pupil would have no right of access.

The records of someone who has died are outside the right of access altogether. Personal data under the Data Protection Act 2018 means information relating to “an identified or identifiable living individual” (section 3(2)), and the ICO’s guidance on health information says “a SAR cannot be used to obtain information about a deceased person”. When a family asks a care home for a late resident’s records, the route is the Access to Health Records Act 1990 (in Northern Ireland, the Access to Health Records (Northern Ireland) Order 1993) where it applies, and the provider’s own decision where it does not.

The 1990 Act covers a “health record”: information about a person’s physical or mental health “made by or on behalf of a health professional in connection with the care of that individual” (section 1), such as a registered nurse’s entries in a nursing home. Where the patient has died, an application may be made by “the patient’s personal representative and any person who may have a claim arising out of the patient’s death” (section 3(1)(f)). A lasting power of attorney or deputyship ends on death and gives its holder no authority to deal with the estate; the guidance for integrated care boards on deceased people’s records suggests asking for a copy of the will naming the executor, a grant of probate or letters of administration. Access must be given within 21 days where every part of the record was made in the 40 days before the application, and otherwise within 40 days (section 3(5)), and “No fee shall be required” for it (section 3(4)). It is refused if the record holds a note, made at the patient’s request, that they did not want access given on such an application (section 4(3)); and the holder must withhold any part that, in its opinion, would disclose information likely to cause serious harm to anyone’s physical or mental health, information identifying another person who is not a health professional involved in the care (unless they consent), anything “not relevant to any claim which may arise out of the patient’s death”, information the patient gave, or that came from an examination or investigation they consented to, in the expectation that it would not be disclosed to the applicant, and any part made before the Act came into force, except where, in the holder’s opinion, access to it is needed to make intelligible a part that must be disclosed (section 5).

Much of what a care home writes is made by care workers, who are not health professionals, so those care notes are usually not health records under the 1990 Act, and UK GDPR no longer applies to what they say about the resident once the resident has died, though it still applies to anything in them about living people, such as family members or staff. They are still confidential: guidance written for integrated care boards on sharing the records of the deceased says “The records of the deceased are still confidential, even after death.” A provider may still decide to share care notes with the family; decide each request on its facts, respect any wish the resident recorded, protect other people named in the notes, and write down what was given, to whom and why.

The SAR log, and the record of each response

The response to a subject access request is itself a record the organisation may have to defend, to the requester, to the ICO or in a tribunal where the request was the opening move in a dispute. Keep a log, and keep a response file for each request.

Keep the response file, what was disclosed and what was withheld with the reasons, for a set period in your retention schedule; a common approach is to keep it for as long as a complaint or claim about the response could reasonably arise. Review the log each term or quarter: patterns of late responses, repeated difficulty finding the same kind of information, or searches that always have to go outside the organisation's own systems are the policy telling you what to fix.

The search the policy cannot finish

Most subject access request policies list the systems to be searched: the personnel file, the pupil record, the care record, email. What the list rarely says is where the conversations about the person actually happened. The request from a member of staff who has raised a grievance will reach the messages their manager exchanged with HR on a Sunday evening. The request from a parent will reach the staff group in which their child's behaviour was discussed. The request from a resident's son will reach what the night carers said about his mother. Those are the pieces a requester most wants, and often already has one side of.

The ICO's guidance says you do not usually have to supply information that someone else holds on their own systems, but it makes exceptions where that person is your processor or where staff have stored the requester's personal information on their personal devices: if you have good reason to think they have, you "should ask them to search their private emails, devices or instant messaging applications, as appropriate". Its subject access request Q&As for employers go further for platforms the organisation itself uses "for business purposes", naming WhatsApp and Teams chat channels among them: "If you receive a SAR, you must search these platforms for any personal information if it falls within scope." "Reasonable and proportionate" is judged on the circumstances; it is not a way of setting aside a place where the organisation knows its staff discuss the people it serves. The practical result is a search that depends on colleagues' goodwill and cannot reach anyone who has left.

ComplyChat is built so that the organisation's work conversations are in its own record before a request arrives. Messages in a ComplyChat channel are recorded on the server as they are sent, everyone added is told the channel is on the record, and a mobile number verified by SMS is an identity, so staff without a work account, volunteers and families can be in the conversation. On paid plans, once your tenant is connected, conversations are kept in your own Microsoft 365 subscription, where your subject access searches already reach, under the retention schedules you already run. It does not reach conversations held elsewhere, and it does not answer the request for you: the exemptions and redactions are still your decisions. ComplyChat Free is one private group, direct messages, up to 25 staff and three calendar months of recent history, with no Microsoft 365 archive.

A question for the next leadership or board meeting: in your last three subject access requests, which of the conversations about the person did your search reach, and which did you have to ask colleagues to look for on their own phones?

Questions people ask

What are the rules for making a subject access request in the UK?

A person can make a subject access request verbally or in writing, including by social media, to any part of the organisation, without using the words "subject access request" and without giving a reason, according to the ICO's guidance on recognising a request. The organisation must respond without undue delay and at the latest within one month of receiving the request, or of receiving the proof of identity or fee it asked for if that comes later (extendable by two further months only where requests are complex or numerous), and in most cases cannot charge a fee.

How long does a subject access request take?

An organisation must answer a subject access request without undue delay and at the latest within one month, counted from the day it receives the request or, if later, the day it receives the identity information or fee it asked for, under Article 12A of UK GDPR, in force since 5 February 2026. It can extend by two further months where that is necessary because of the complexity or number of the person's requests, if it tells them why within the first month, and the days from asking for clarification it reasonably needs to identify what the request relates to until receiving it do not count. Our SAR and FOI deadline calculator works out the date.

How much does a subject access request cost?

Usually nothing: under Article 12(5) of UK GDPR the actions taken on a subject access request "shall be provided free of charge", and the ICO's guidance on responding to a request says "In most cases, you cannot charge a fee to comply with a SAR." An organisation may charge "a reasonable fee taking into account the administrative costs", or refuse, only where a request is manifestly unfounded or excessive, which the organisation has to be able to show, and may charge a reasonable fee for further copies under Article 15(3).

How far back can a subject access request go?

There is no cut-off date: a subject access request reaches the personal data the organisation holds when the request arrives, however old it is, because the ICO's guidance on finding and retrieving the information says "A SAR is about the information you hold at the time you receive the request." The search has to be reasonable and proportionate (Article 15(1A)), and information kept beyond its retention period is still in scope if it is still held. Routine deletion can carry on while you deal with the request, but the ICO says "it’s not acceptable to amend or delete the information if you would not otherwise have done so", and destroying or concealing information to stop it being disclosed is an offence under section 173 of the Data Protection Act 2018.

Do I need to give a reason for a SAR?

No. The ICO's guidance on recognising a request says people do not have to tell an organisation their reason for making a request or what they intend to do with the information, so a request made during a grievance or dispute is still valid.

What should be included in a SAR response?

A copy of the person's personal data, with the supplementary information Article 15 requires: the purposes of processing, the categories of data, the recipients, how long it will be kept, the rights to rectification, erasure, restriction and objection, the right to complain, the source of the data if not the person, any automated decision-making, and, where data is transferred abroad in reliance on Article 46, the safeguards for the transfer. If the request was made electronically, provide the response in a commonly used electronic form unless the person asks otherwise.

What happens if an organisation doesn't respond to a SAR?

The requester can complain to the organisation or the ICO, or go to court. The ICO's guidance Can the right of access be enforced? says the ICO may then issue warnings, reprimands and enforcement or monetary penalty notices, the requester may apply for a court order requiring the organisation to comply, and people harmed by a breach of their rights are entitled to claim compensation.

On what grounds can a SAR be refused?

An organisation can refuse to comply with a subject access request, wholly or partly, where an exemption applies or where the request is manifestly unfounded or excessive, according to the ICO's guidance on what exemptions are relevant for SARs and on when a SAR is manifestly unfounded or excessive. When it does not act on a request, Article 12(4) of UK GDPR requires it to tell the person, without undue delay and within the time limit, the reasons and the possibility of complaining to the organisation under section 164A of the Data Protection Act 2018, complaining to the Information Commission (the ICO) and seeking a judicial remedy.

What is the difference between a SAR and a DSAR?

There is none: a data subject access request (DSAR) and a subject access request (SAR) are two names for the same request under Article 15 of UK GDPR. The ICO’s guidance for the public, Getting copies of your information, says the right of access “is also known as making a subject access request, a SAR or a DSAR”, and the same one-month time limit, exemptions and rules apply whichever name the requester uses.

Official guidance and your next step

The ICO's right of access guidance is the authority, and the pages linked above cover each step. For the 2025 changes, read the ICO's summary of the data protection changes and the government's guidance on the Act. The Data (Use and Access) Act 2025 amended UK GDPR and the Data Protection Act 2018 in stages and the ICO has been updating its guidance to match, so check the date on any ICO page you rely on. Quotations here are from those pages as published on 25 September 2026; the time-limit passages from Article 12A and the ICO's guidance were checked again on 30 October 2026, and the passages added on 10 November 2026 (Articles 12, 12A and 15 of UK GDPR, section 78 of the 2025 Act, sections 164A and 173 of the Data Protection Act 2018, and the ICO's pages on fees and searches) were read between 8 and 10 November 2026. Schools should also read the Department for Education's data protection in schools guidance.

This guide is general information for UK schools, charities and care providers, not legal advice. A request connected to a grievance, a claim or a safeguarding matter is one to take advice on.

One step to take this term: write down, for your organisation, every place a conversation about a member of staff, a pupil or a resident could be held, and mark which of them your SAR procedure actually searches. Then give the list to whoever handles your next request.