Data Governance Atlas UK edition

Subject access requests

How a subject access request works under the UK GDPR and the DPA 2018, as amended by the DUAA 2025. Three things separate a UK SAR from a generic GDPR guide: the codified reasonable and proportionate search standard, the statutory stop-the-clock rules, and a criminal offence (DPA 2018 s.173) for destroying or concealing records to defeat a request. One failure can carry regulatory, criminal and civil consequences at once.

Applies to
Any controller subject to the UK GDPR, for requests under Art 15. Part 3 (law enforcement, s.45) and Part 4 (intelligence services, s.94) have their own access rights, which the DUAA search standard also amends; this procedure follows Part 2.
Instruments
UK GDPR, DPA 2018
Steps
10 steps, with a deadline calculator, including a step that carries a criminal offence.

Deadline calculator

Subject access request

One calendar month from receipt, to the corresponding date in the next month (or the last day of a shorter month). If that is a weekend or bank holiday, the next working day. Add any days the clock was stopped. Extension: two further months.

Enter a date to calculate.

Basis: UK GDPR Art 12(3); DUAA 2025 s.76 (requests from 2026-02-05). Bank holidays for 2025 to 2028, by the standard calendar rules. A calculator, not advice.

Acknowledge a data protection complaint

Acknowledge within 30 days of receiving the complaint (complaints received from 2026-06-19).

Enter a date to calculate.

Basis: DPA 2018 s.164A(3). Bank holidays for 2025 to 2028, by the standard calendar rules. A calculator, not advice.

Mechanics

Item Position
Deadline One calendar month from receipt of a valid request
Extension Two further months for complex or numerous requests, notified within the first month
Stop the clock Codified by the DUAA (s.76) for requests received from 2026-02-05, while reasonably waiting for identity or clarification
Search standard Reasonable and proportionate (DUAA s.78, treated as in force from 2024-01-01)
Cost Free by default
Form or reason required No
Exemptions DPA 2018 Schedules 2 to 4, each with its own trigger test
Complaints route Controller's own complaints process first (from 2026-06-19), then the Information Commission
Criminal backstop DPA 2018 s.173, altering or concealing records to prevent disclosure

Steps

  1. Receive and log

    A request can be made in any format, to anyone in the organisation, verbally or in writing, with no prescribed form and no reason given. A request embedded in a complaint letter still counts. Log the date it arrived: the clock runs from receipt of a valid request, not from when it reaches the right team.

    See UK GDPR

  2. Verify identity only where there is genuine doubt

    Ask for identification only where you genuinely doubt who is asking, and only for proportionate evidence. Where you reasonably need it, the clock stops while you wait for it (s.76, for requests received from 2026-02-05) and restarts when it arrives.

    See UK GDPR

    Over-verification is a commonly upheld complaint. Asking for a passport and a utility bill from a known current employee is not proportionate.

  3. Clarify scope only if the request is genuinely unclear

    Where you process a large amount of information about the person and the request is genuinely unclear, you may ask them to specify what they want, and the clock stops while you reasonably wait. Clarification is not a delay tactic, and a broad request is not an unclear one: "everything you hold about me" is clear.

    See UK GDPR

  4. Search reasonably and proportionately

    Search what a reasonable and proportionate search would cover: live systems, email, case management, HR, CCTV where relevant, and archives and backups where reasonably accessible. Since DUAA s.78 the entitlement itself is limited to what such a search can find, which gives a statutory anchor for proportionality. Record what you searched and why you stopped, because that record is your defence if the search is challenged.

    See UK GDPR

    The standard is new in statute and its practical bar has not been settled by case law. Read it as a codified reasonableness test, not a licence to search less.

  5. Apply exemptions by their trigger tests

    Use DPA 2018 Schedules 2 to 4, and apply each exemption's own test rather than its name: crime and taxation (Sch 2 para 2) only to the extent that disclosure would be likely to prejudice those purposes; immigration (Sch 2 para 4) only with the 2022 safeguards. Third-party data is redacted or withheld by balancing, not used to refuse the whole request. Legal professional privilege and management forecasting have their own conditions.

    See DPA 2018

  6. Respond in full

    Provide a copy of the personal data plus the Art 15(1) information: purposes, categories, recipients, retention period or the criteria for it, the rights to rectification, erasure, restriction and objection, the right to complain to the Information Commission, the source of the data if not collected from the person, and the existence and logic of any automated decision-making.

    See UK GDPR

    Criminal offence Once a request has been made, altering, defacing, blocking, erasing, destroying or concealing information to prevent its disclosure to the requester is a criminal offence under DPA 2018 s.173, not just a regulatory breach. Fine-only, recordable, and directors can be personally liable under s.198.

  7. Meet the deadline

    One calendar month from receipt of a valid request, excluding any period the clock is stopped. Extendable by two further months for complex or numerous requests, but only if you tell the requester about the extension and the reason within the first month.

    See UK GDPR

  8. Do not charge, save in narrow cases

    Free by default. A reasonable fee is allowed only for manifestly unfounded or excessive requests, or for further copies of the same information.

    See UK GDPR

  9. Refuse only where you can show why

    A manifestly unfounded or excessive request may be refused. You must be able to show why, and you must tell the requester of the right to complain to the Information Commission and to seek a judicial remedy.

    See UK GDPR

  10. Handle complaints, and know the three consequences

    A dissatisfied requester complains to you first, through the complaints process controllers must run for complaints received from 2026-06-19 (new DPA 2018 s.164A), and then to the Information Commission. One failure can attract three different consequences: under-searching is regulatory (enforcement notice, s.155 penalty); destroying records to dodge the request is criminal (s.173); ignoring it outright can be both, plus a compensation claim under Art 82 UK GDPR and s.168 DPA 2018.

    See DPA 2018

Checklists and tools for this procedure

Which access regime applies?

Decision tool

Route an information request to the right law and regulator: subject access, FOIA, EIR, FOISA or the Scottish EIR.

Subject access: intake and stop-the-clock assessment

Checklist for data protection

Work a subject access request from receipt to response, recording each decision that stops the clock, extends it or narrows the search.

Explainers

Sources