Fixing How You Handle Subject Access and Other Data Rights Requests
Anyone whose personal data you hold can ask what you have about them, ask you to correct it or delete it, or object to how you use it. Most small businesses meet these requests rarely, which is exactly why they go wrong: an email is missed, nobody knows which systems to search, and the one-month deadline passes.
The GDPR Audit checks whether your site gives people a visible route to make a request. This guide turns that into a working process: how people ask, how you recognise and log a request, how you check identity, where to search, and how to reply properly and on time.
Data subject access requests must be answered within one month in most cases.
- Before you start: this is not legal advice
- The rights people can use
- Working out the one-month deadline
- The fix, step by step
- Where personal data hides in a small business
- Handling erasure, objection and correction requests
- Changes from the Data (Use and Access) Act 2025
- Keeping the process working
- Questions and answers
Before you start: this is not legal advice
This guide describes the rights in the UK GDPR and a sensible way for a small organisation to handle them. It is not legal advice. Requests that arrive during a dispute with an employee or customer, requests involving health or social care records, and requests where you want to refuse or withhold information are all situations where advice from a solicitor or data protection specialist is worth getting. The ICO publishes detailed guidance on the right of access and each of the other rights.
The Data (Use and Access) Act 2025 makes some changes to how requests are handled, described further down. Its provisions are being brought into force in stages, so check the ICO's current guidance before relying on any of them.
The rights people can use
The right of access, usually called a subject access request or SAR, is the one you will see most. The others matter too, and several have conditions that decide whether they apply.
| Right | UK GDPR | What it means in practice | Always applies? |
|---|---|---|---|
| To be informed | Articles 13 and 14 | Your privacy notice explains what you do with data. Covered in the privacy policy guide. | Yes, with limited exceptions. |
| Access | Article 15 | A copy of their personal data plus supporting information such as purposes, recipients and retention. | Yes, subject to exemptions. |
| Rectification | Article 16 | Correct inaccurate data and complete incomplete data. | Yes, where the data is inaccurate. |
| Erasure | Article 17 | Delete data, for example when it is no longer needed or consent is withdrawn. | No. You may keep data you must hold by law, such as accounting records. |
| Restriction | Article 18 | Pause use of data while accuracy or an objection is checked. | Only in set circumstances. |
| Portability | Article 20 | Data the person gave you, in a structured, machine-readable format. | Only for processing based on consent or contract and carried out by automated means. |
| Objection | Article 21 | Stop processing based on legitimate interests or public task, unless you have compelling grounds. | Objection to direct marketing is absolute. |
| Automated decisions | Article 22 | Safeguards around significant decisions made purely by automated means. | Only where such decisions are made. The 2025 Act reshapes this area. |
A request can be made verbally or in writing, to anyone in the business, through any channel, including social media messages and a chat widget. It does not have to mention the UK GDPR, say "subject access request" or use your form. "Can you send me everything you hold about me?" is a valid request.
Working out the one-month deadline
You must respond without undue delay and at the latest within one month of receiving the request. The ICO's guidance explains how to count it:
- Start from the day you receive the request, whether or not it is a working day.
- The deadline is the same date in the following month. A request received on 3 September is due by 3 October.
- If the following month has no matching date, use its last day. A request received on 31 January is due by the end of February.
- If the deadline falls on a weekend or bank holiday, you have until the next working day.
If you need proof of identity, the clock starts when you receive it rather than when the request arrived. You can extend the deadline by up to two further months if the request is complex or the same person has sent several, but you must tell them within the first month and explain why.
| Request received | Normal deadline | With a full extension |
|---|---|---|
| 3 September | 3 October | 3 December |
| 31 January | 28 or 29 February | 30 April |
| A Saturday | The same date next month, moved to the next working day if that date is a weekend or bank holiday | Three months on, with the same working-day rule |
The fix, step by step
Step 1
Give people a clear way to make a request
Add a short section to your privacy notice listing the rights people have and one named
route to use them, such as a dedicated address like privacy@example.co.uk or a simple web
form. Link it from the footer and the contact page. You cannot insist that people use the route, because
a request made any other way still counts, but a clear route means most requests arrive where someone
is expecting them and nothing sits unread.
Step 2
Teach everyone to recognise a request
Brief everyone who reads customer messages, including sales, support and whoever manages social media, that a request for someone's data, a request to delete their account or an objection to marketing can arrive in any wording and through any channel. Ask them to forward it to the named person the same day with the original message and the date and time it arrived, rather than trying to answer it themselves or waiting for a quiet moment.
Step 3
Log the request and work out the deadline
Record every request in a log with a reference, the person's name, the right being used, the channel, the date received and the calculated deadline. Send a short acknowledgement that confirms receipt and tells them when to expect a reply. If the request is unclear, ask what they are looking for, but keep working on the parts that are clear. Set a calendar reminder a week before the deadline.
Step 4
Check identity in proportion to the risk
Only ask for proof of identity when you genuinely have doubts, and ask for no more than you need. A request from the email address already on the customer's account may need nothing further. Asking for a passport copy to send someone a newsletter history is excessive. If a relative, solicitor or other third party asks on someone's behalf, check they have the person's written authority before releasing anything.
Step 5
Search every place the data lives
Work through a written list of systems rather than relying on memory: the website database and form entries, the shared inbox and personal mailboxes, the CRM, email marketing platform, help desk, order and invoicing systems, chat tools, spreadsheets and paper files. Search by name, email address, phone number and customer number. Record where you searched and what you found, so you can show the search was reasonable if the person later complains.
Step 6
Remove other people and apply exemptions
Before sending anything, check each document for information about other people, such as colleagues' opinions or other customers in the same email thread. Remove it unless they have agreed or it is reasonable to disclose. Use true redaction that deletes the text, not a black box drawn on top. Consider whether an exemption in the Data Protection Act 2018 applies, such as legal privilege, and note why you withheld anything.
Step 7
Reply, explain and keep a record
Send the data in a format the person can use, usually a PDF or spreadsheet sent securely, with a covering letter that explains the purposes, the sources, who receives the data, how long you keep it and their rights, including the right to complain to the ICO. For erasure, correction or objection, confirm exactly what you changed. Close the log entry with the date sent, and keep a copy of what you sent.
Where personal data hides in a small business
The search is where most responses fall short. The person asking often knows about an email thread or a note that you have forgotten. This list covers the places a typical small business with a website should check.
- Website database. User accounts, orders, form submissions stored by plugins, comments and newsletter sign-ups held locally.
- Email. The shared inbox, personal mailboxes of anyone who dealt with the person, and sent items. Archive and deleted folders count while the data still exists.
- Customer tools. CRM records and notes, help desk tickets, live chat transcripts, call recordings and booking systems.
- Marketing platforms. Email marketing lists, including the history of what was sent and opened, and any advertising audiences uploaded from your customer list.
- Finance. Invoices, payment records and accounting software. These are often exempt from erasure because you must keep them, but they are still included in access requests.
- Files and chat. Shared drives, spreadsheets on laptops and internal messaging where staff discussed the person.
- Backups. You do not normally need to restore a backup to answer an access request if the live data is complete, but deleted data kept in backups should be dealt with through your backup retention, not left indefinitely.
Analytics tools usually hold pseudonymous data tied to a cookie identifier rather than a name. If you cannot link that data to the person without extra information you do not hold, you generally do not need to try, but say so in your reply if it is relevant.
Handling erasure, objection and correction requests
Erasure
Delete the data from live systems and ask processors who hold it for you, such as your email platform, to delete it too. Keep what you are legally required to hold, such as invoices for tax purposes, and explain that in your reply. For newsletter sign-ups it is usually better to keep a minimal suppression entry, just the email address marked "do not contact", so the person is not added again later by mistake. Tell them you are doing this.
Objection to direct marketing
This right is absolute: once someone objects, stop sending them marketing, with no balancing test. Unsubscribe links should take effect promptly, and a reply saying "please stop emailing me" counts even if it does not use the link.
Correction
Update the record everywhere it is held, including in suppliers' systems. If you disagree that the data is wrong, for instance a record of what the person said on a call, you can keep it but add a note of their view and explain your decision.
Portability
Where it applies, provide the data the person gave you in a common format such as CSV or JSON. A spreadsheet of their order history and account details usually meets the need for a small business.
Changes from the Data (Use and Access) Act 2025
The 2025 Act amends the UK GDPR and the Data Protection Act 2018. For rights requests, the main changes as generally described are these, and they apply only once the relevant provisions are in force:
- Reasonable and proportionate searches. The Act puts into law the principle, already in ICO guidance, that you need to make reasonable and proportionate searches rather than every conceivable search.
- Pausing the clock. Where you reasonably need more information to identify what the person is asking for, the time limit can pause until they provide it.
- Complaints to you first. Organisations are expected to have a way for people to complain to them about how their data is handled, to acknowledge complaints within a set period and to deal with them promptly.
- Automated decision-making. The rules on decisions made without human involvement are reshaped, with safeguards such as a way to contest the decision and obtain human intervention.
None of this changes the basics: recognise requests, search properly, reply within the time limit and keep records. Check the ICO's guidance for the current position on each change.
Keeping the process working
- Keep a data map. A one-page list of systems that hold personal data makes every search faster and doubles as part of your records of processing.
- Review the log every few months. Repeated requests about the same issue, such as marketing emails after unsubscribing, point to a fix elsewhere.
- Update the route when staff change. A privacy address that forwards to someone who has left is a common way requests go missing.
- Keep templates ready. An acknowledgement, a request for clarification, an extension notice and a covering letter save time and keep replies consistent.
- Delete on schedule. The less old data you hold, the less there is to search, redact and send.
For how these rights fit into the rest of your obligations, see the GDPR Guide and the beginner tutorial.
1. How long do I have to respond to a subject access request?
One month from the day you receive it, counting to the same date in the next month, or the last day of that month if there is no matching date. If the deadline falls on a weekend or bank holiday, you have until the next working day. If you need proof of identity, the clock starts when you receive it. For complex or multiple requests you can extend by up to two months, but you must tell the person within the first month.
2. Does a subject access request have to be in writing?
No. A request can be made verbally, by email, through a web form, by letter or through social media, and it does not have to mention data protection law or use any particular phrase. That is why everyone who reads customer messages needs to recognise one. For verbal requests, write down what was asked and confirm it back to the person in writing, so there is a clear record of the request and its date.
3. Can I ask for ID before answering a request?
Yes, but only when you have reasonable doubts about who is asking, and only for what you need to be sure. A request from the email address already linked to the account may need nothing more. Asking for a passport or utility bill as a matter of routine is usually excessive for a small business. Where you do ask, the one-month clock starts when you receive the information, so ask promptly.
4. Do I have to delete someone's data if they ask?
Not always. The right to erasure applies in set circumstances, such as when the data is no longer needed, consent is withdrawn, or the person objects and you have no overriding reason to continue. You can keep data you are legally required to hold, such as invoices and accounting records, or that you need for legal claims. Delete what you can, explain what you have kept and why, and tell your processors to delete their copies too.
5. Can I charge a fee for a subject access request?
Normally no. Requests are free. You can charge a reasonable fee based on your administrative costs only if a request is manifestly unfounded or excessive, or if the person asks for further copies of information you have already provided. In those cases you can also consider refusing, but you must be able to justify the decision and tell the person why and that they can complain to the ICO. Record your reasoning in the request log.
6. Do I have to send emails that mention the person?
You must provide the personal data about them, which can include their name in emails and what was said about them, but not necessarily the whole email. Often the practical answer is to provide copies of relevant messages with other people's information removed. Emails that merely copy them in with no information about them may not need to be included. Keep a note of how you decided what was in scope.
7. What happens if we miss the one-month deadline?
Reply as soon as you can, apologise and explain the delay. Missing the deadline is an infringement and the person can complain to the ICO, which may ask you to respond and can take further action if there is a pattern. More commonly, a late reply damages trust and prompts a complaint that takes longer to handle than the request would have. A request log with calendar reminders is the simplest protection.
The GDPR Audit checks what a visitor can see, including the privacy policy and the routes people have to exercise their rights, alongside the cookie banner and scripts that load before consent.
Open GDPR Fixes →