Quick answer: a subject access request is a person asking for a copy of the personal information you hold about them. Under UK GDPR you must respond without undue delay and within one month, usually free of charge, after a reasonable and proportionate search. Log the request on the day it arrives, confirm who is asking, then gather, check and send.
Sooner or later, a patient, a care home resident's relative, an employee or a supporter will ask what information you hold about them. For a dental practice, care provider or small charity with no data protection team, the first subject access request can feel daunting. This guide explains what the law asks of you, using the Information Commissioner's Office (ICO) guidance, and sets out a simple process a small team can follow every time.
What is a subject access request?
A subject access request, or SAR, is someone using their right of access under UK GDPR to get a copy of their personal information from you. According to the ICO's guide to subject access (last updated 16 July 2026, read 13 October 2026), a person can make a request verbally or in writing, including through social media.
That matters for a small organisation. A request does not need a form, a particular wording or the words "subject access request". A patient asking at reception, a relative emailing a care manager or a volunteer messaging your charity's page can all be making a valid request. Everyone who deals with the public should know how to recognise one and where to pass it.
How long do you have to respond to a SAR?
You must respond without undue delay and at the latest within one month of receiving the request. The ICO's guidance adds three rules that affect the clock:
- Identity checks: if you reasonably need proof of who is asking, the time limit does not start until you receive it. Ask only for what is necessary; you do not need formal ID from a patient you see every month.
- Clarification: if you hold a lot of information and genuinely need the person to clarify what they want, the clock pauses on the day you ask and restarts the day after they reply. You cannot force them to narrow the request.
- Extensions: you can extend by up to two further months if the request is complex or the same person has made several requests. You must tell them, with your reasons, within the first month.
Write the date of receipt on your log the day the request arrives. Most missed deadlines start with a request that sat in someone's inbox for a week.
Can you charge a fee for a subject access request?
In most cases, no. The ICO says you can only charge a reasonable fee for your administrative costs if a request is manifestly unfounded or excessive, or if the person asks for further copies of information you have already provided. If you do charge, ask for the fee promptly and explain how you worked it out. The same test applies to refusing a request, and the ICO describes the threshold for relying on it as high.
What do you have to send back?
You must send a copy of the person's personal information plus supplementary information, which largely matches what your privacy notice already covers: why you use their information, who you share it with, how long you keep it and where it came from. If the request came in electronically, send the information in a commonly used electronic format unless they ask otherwise, and make sure it is clear and sent securely.
You must make a reasonable and proportionate search. For a small organisation that usually means checking:
- your practice management, care planning or supporter database
- email accounts, including shared inboxes
- shared drives and cloud storage
- paper files and diaries
- messaging apps staff use for work, if any
Before anything leaves the building, read it through. Information about other people, such as other patients, residents, staff or family members, usually needs to be removed or considered carefully, and the ICO lists other exemptions that may apply. If you hold something back, you must say why and explain that the person can complain to you, to the ICO or to the courts.
What if someone asks on behalf of another person?
A relative, friend or solicitor can make a request for someone else, but it is the third party's job to show they have authority to act. You must be satisfied they are entitled to the information before you release it. In care settings this comes up often, so agree in advance what evidence you will accept, such as a signed authority or a lasting power of attorney, and record what you saw.
A simple SAR process for a small team
- Recognise it. Brief every member of staff and volunteer: any request for "my records" or "what you hold on me" goes to one named person the same day.
- Log it. Record the date received, who asked, what they asked for and the deadline.
- Check identity, proportionately. Only ask for proof if you are genuinely unsure who you are dealing with.
- Search. Work through your systems using a checklist like the one above.
- Review. Remove other people's information and apply any exemption, noting your reasons.
- Send securely. Use an encrypted email or secure portal, with a short covering letter that includes the supplementary information.
- Close the log. Note the date sent, so you can show you met the deadline.
If you complete the Data Security and Protection Toolkit, this kind of written procedure and record is useful evidence of good information governance. Our DSPT step-by-step guide explains how the toolkit fits together, and there are sector guides for dental practices, care providers and charities. Where a supplier holds information for you, your contract should say how they will help you answer requests; ours is set out in our data processing agreement.
FAQs
Does a subject access request have to be in writing?
No. The ICO is clear that a request can be made verbally or in writing, including on social media. If someone asks in person or on the phone, write down what they asked for and confirm it back to them, so there is no doubt about the scope.
Can a former employee make a subject access request?
Yes. The right of access applies to anyone whose personal information you hold, including former staff and volunteers. Their request will often cover HR files, emails that mention them and rota or payroll records, so search those systems carefully.
Do we have to send original documents?
No. The right is to a copy of the personal information, not the original records. Keep your originals and send copies in a clear, readable format.
What happens if we miss the one-month deadline?
Send the response as soon as you can and apologise for the delay. The person can complain to the ICO, which can take action if an organisation fails to comply. A simple log with dates is the best way to avoid this happening again.
How we can help
Unavoidably Secure offers independent audits for dental practices, care providers and small charities. We can review how requests reach your team, where personal information is stored and how securely it is sent, and tell you plainly what to tighten. We do not certify or guarantee compliance, and nothing in this article is legal advice. For more guides, head back to the blog.
Want a second pair of eyes on your data handling?
Book a free external audit. We will look at your website, email security and how personal information leaves your organisation, and tell you plainly what to fix.
Book a free auditNeed help with this?
If you need support putting any of this right, contact us today. Tell us briefly what you need and Andrew will reply within one working day. Prefer to talk? Call 07749 941111.