Guides · 7 min read
Responding to a subject access request
Most late responses are late because the request sat in a shared mailbox for two weeks before anybody recognised it as one.
It probably does not look like a request
There is no prescribed form. A request can be verbal, can arrive in a complaint, can go to anybody in the organisation, and need not mention data protection at all. "Send me everything you have got about me" in the middle of a grievance email is one. The practical consequence is that recognising them is a training problem before it is a process problem.
The clock starts on receipt
One calendar month from when it arrived — not thirty days, not a month from when it reached the right person. A calendar month is why the arithmetic matters: a request received on 31 January is due at the end of February. Recording the date of receipt, and how that date was established, is the first thing to do.
An extension exists, and it has conditions
The period can be extended by two further months where necessary, taking into account complexity and the number of requests — but the individual has to be told within the first month, and told why. An extension decided in week six is not an extension.
Write the decisions down as you make them
Redactions, exemptions, third-party data, whether identity verification was needed: each is a judgement, and each is one you may have to explain a year later. Recording the reasoning at the time takes minutes; reconstructing it afterwards is guesswork with your name on it.
Keep two timelines apart
What the requester sees and what the team discusses internally are different records. "We received your request" belongs in one; "we have asked our solicitor about paragraph four" belongs in the other. Systems that keep a single thread tend to disclose the second by accident.
Who decides what
Whether an exemption applies is a judgement for you and your adviser. Nothing here, and nothing in DutyHub, makes that decision — what the product does is run the clock properly and keep the reasoning where it can be found.
This guide describes what organisations are commonly asked for. It is not legal advice and it is not a statement of what your organisation must do — that depends on your premises, your activities and your own assessment, and it is a question for you and your adviser. The regime pages linked below name the legislation so you can read the source.