Subject Access Request Procedure Template for UK Businesses
Under UK GDPR, individuals have the right to request a copy of all personal data your business holds about them. You must respond within one month — a written SAR procedure ensures you do it correctly every time.
Instant PDF & Word download · 14-day money-back guarantee
What is a subject access request procedure?
A subject access request (SAR) procedure is a document that sets out how your business handles requests from individuals who want to see the personal data you hold about them. Under UK GDPR Article 15, every individual has this right, and businesses must respond within one calendar month.
Without a written procedure, businesses often miss deadlines, provide incomplete responses, or inadvertently share data about third parties — all of which can result in ICO complaints and enforcement action. A clear procedure protects you and ensures you treat individuals' rights seriously.
What your SAR procedure should cover
- How to recognise a SAR (they do not need to use specific wording or be in writing)
- Who is responsible for handling SARs within your business
- How to verify the identity of the person making the request
- The one-month response deadline and when an extension applies
- How to locate, compile, and review all data held about the individual
- How to redact third-party information from the response
- What to include in the response: the data, plus supplementary information
- How to handle complex, manifestly unfounded, or excessive requests