Data Subject Access Requests

Individuals have the right under the UK GDPR to ask what personal data you hold about them, what you do with it, and why. This is commonly referred to as a subject access request (often shortened to “SAR”).

This collection is designed as a practical toolkit: the documents are intended to work together so you can follow a clear process from recognising a request through to issuing the appropriate response.

When Should You Use These Templates?

Use this collection if you want a structured way to handle SARs, including:

• recognising requests in practice (there is no prescribed format a SAR must follow);
• acknowledging receipt and, where appropriate, asking for clarification or proof of identity before disclosing data;
• managing time limits (usually one month, with a limited ability to extend where requests are complex or numerous);
• dealing with the limited situations where a fee can be charged (for example where a request is “manifestly unfounded or excessive”); and
• responding consistently, including where you locate no relevant personal data.

What Templates Are Included?

Policies And Guidance (How The Process Works)

Data Subject Access Request Guidance Notes

Practical guidance explaining how SARs work and what to do at each stage, including recognition, what information must be provided, time limits, fees, requests made on someone else’s behalf, and dealing with data about other individuals and processors.

Data Subject Access Request Policy and Procedure

An internal policy setting out the end-to-end SAR process, including who does what, recognising requests, clarifying scope, time limits, fees, searches, exemptions, and refusal grounds. It reflects the Data (Use and Access) Act 2025 requirement for reasonable and proportionate searches.

Employee Guide to Making a Subject Access Request

An employee-facing policy explaining the right of access and how staff can make a SAR to their employer, including response times, fees, and complaints.

Subject Access Requests: Staff Guide

Provides employees and other individuals working on behalf of an organisation with guidance on how to recognise and assist with Subject Access Requests (SARs).

A Form Individuals Can Use (Optional)

Subject Access Request Form

A standard form you can make available to help individuals provide the details you need to locate their personal data and understand their request, while recognising that individuals cannot be required to use a specific form.

Response Letters (Covering Common Scenarios)

SAR Letter - Acknowledgement

An initial acknowledgement letter with options to confirm the usual response timeframe and, where needed, request proof of identity or further information to clarify the request.

SAR Letter - Request for Clarification

A letter to request further information from an individual where clarification is reasonably required to identify the personal data or processing activities covered by a Subject Access Request.

SAR Letter - Receipt of Clarification

A letter to acknowledge receipt of clarification provided by an individual in response to a SAR clarification request, and to confirm the revised deadline for responding to their SAR.

SAR Letter - Fee

A letter for cases where you need to explain an extension (and the reasons), for example for a complex request, or where a fee is being charged because a request is manifestly unfounded or excessive.

SAR Letter - Receipt of ID or Authority

A letter acknowledging receipt of clarification or identity evidence and confirming the date by which you will provide the substantive response.

SAR Letter - Receipt of Fee

A letter acknowledging receipt of a fee charged in the limited circumstances permitted, and confirming the date by which you will respond.

SAR Letter - Extension of Time

A letter to notify an individual that additional time is required to respond to their Subject Access Request (SAR).

SAR Response Letter - Data Held

A letter to respond to a Subject Access Request where personal data relating to the individual is held and is being disclosed in accordance with UK data protection law.

SAR Letter - No Data Found

A response for situations where your searches have revealed no personal data about (or relating to) the individual, suitable either following initial receipt or after receiving clarification or identity evidence.

SAR Response Letter - Partial Disclosure

A letter to respond to a Subject Access Request where some personal data is being disclosed, but certain information must be withheld or redacted because an applicable exemption or other restriction.

SAR Response Letter - Refusal

A letter to formally refuse to comply with a Subject Access Request in full, where there are valid grounds for refusal under UK data protection law.

Why Use These Templates?

These templates are designed to help you implement a repeatable SAR handling process, rather than responding ad hoc each time:

• The policy and guidance notes help staff recognise SARs and follow a consistent workflow, including time limits, searches, and exceptions.
• The optional form helps individuals give you enough information to locate their data efficiently and reduce back-and-forth.
• The letter set supports clear, consistent communication at each stage, especially where you need ID, clarification, additional time, a fee, or where no data is found.

For more information about each document in this collection, please click on the links below:

Data Subject Access Requests is part of Business . Just £42.50 + VAT provides unlimited downloads from Business for 1 year.