As an employer, you normally have one month to respond to a data subject access request (DSAR), but you only have to provide what a reasonable and proportionate search would find. Here’s how to handle a DSAR step by step, including what you can withhold, when you can extend the deadline and when you can refuse.
Key takeaways
- You normally have one month to respond, counted from the day the request arrives, even if this is outside working hours.
- Asking the requester to clarify their request pauses the clock until they reply.
- You only have to provide the personal data a reasonable and proportionate search would find.
- Some information is exempt, including legal advice, management forecasts and references given in confidence.
- A DSAR can’t be refused just because it’s long, written with AI or linked to a dispute.
The short answer
Under Article 15 of the UK GDPR, anyone can ask an organisation for access to the personal data it holds about them. This is a data subject access request (DSAR, also called a SAR). As an organisation, you normally have one month from the day you receive it to respond.
To respond well to a DSAR, confirm who’s asking, work out the deadline and clarify what they want. Then run a reasonable and proportionate search, review the results and redact or withhold anything exempt. Send the data with the supplementary information Article 15 requires, and tell the requester how to complain.
You can extend the deadline by up to two further months if the request is complex. You can only refuse a DSAR if it’s manifestly unfounded or manifestly excessive, and you must explain why.
What is a DSAR?
A DSAR is a request from an individual to see the personal data an organisation holds about them. Article 15 of the UK GDPR gives individuals this right of access. Examples of an organisation could be their employer, a club or body they belong to, or a business they’ve bought from.
What is personal data? Information that relates to an identified or identifiable person. Just mentioning their name doesn’t necessarily make something personal data: the information has to be about that person.
Within one month of receiving a DSAR, you must confirm whether you process the requester’s personal data. If you do, you must give them a copy or provide appropriate access. You also need to provide supplementary information about your processing, which is usually found in a privacy policy.
Why are DSARs on the rise?
Many organisations of every size are reporting a rise in DSARs over the past few years. People understand their data protection rights better, and many now use AI tools to research their rights and draft requests.
DSARs rarely come from a happy place. They’re a way to gather information, and they usually come alongside or ahead of a dispute, such as an Employment Tribunal claim.
How should you respond to a DSAR?
Step 1: Recognise the request.
Most DSARs arrive by email, but a request is valid in any format, including in person or verbally. Make sure your staff can recognise a DSAR and know how to start your process.
Step 2: Verify the requester.
If you’re unsure who’s asking, ask for a copy of their ID. Don’t ask for ID if it’s clear from the circumstances that the requester is who they say they are.
Sometimes a third party, such as a friend or solicitor, makes the request for the individual. Only go ahead once the individual has confirmed the third party can act for them.
Step 3: Calculate the deadline.
The clock starts on the day you receive the DSAR. For an email, that’s the day it arrives, even if this is outside business hours.
Step 4: Acknowledge the request.
This isn’t a legal requirement, but it is best practice. If it’s easy to do, you can also send the Article 15 supplementary information now. This covers how and why you process the person’s data, how long you keep it and who you share it with. A staff privacy policy is the best place to keep it.
Step 5: Ask for clarification if you need it.
Broad requests often don’t make clear what the requester is looking for, so ask as soon as possible. Under updates to the UK GDPR made by the Data (Use and Access) Act 2025 (DUAA), asking for clarification pauses the clock. The clock restarts on the day you receive their reply.
Step 6: Run a reasonable and proportionate search.
If clarification narrows the request, the search becomes more manageable. If the requester won’t clarify and still asks for “all personal data about me”, you can’t simply refuse to deal with it.
The DUAA has written the ICO’s existing guidance into law: an individual is only entitled to personal data found by a reasonable and proportionate search. (Note: the Information Commission replaces the Information Commissioner’s Office, but is still known as the ICO).
What’s reasonable and proportionate depends on your organisation and the request, including your size and resources. ICO guidance says you don’t have to carry out searches that are unreasonable and disproportionate to the importance of the information. Ask yourself what seems to have triggered the DSAR, when it happened, and what date range, categories or records, and keywords that suggests.
What happens at the search stage
Strip the request back. At its recent Data Protection Practitioners’ Conference, the ICO addressed long, AI-generated DSARs. Its advice was to look past a request’s apparent sophistication or aggressive tone and think about the person behind it. Try to sum up, in one sentence, what the individual seems to want.
Focus on the key people. The conference also supported identifying the people involved in relevant decisions about the requester, such as their line manager and HR contact. That’s more proportionate than searching every mailbox in the company. A clarification request can help you find out who exchanged relevant communications.
Search by subject, not just by name. A name-only search is one of the most common mistakes we see. Data is only personal data if it relates to the individual. Emails that simply show an employee doing their day-to-day work aren’t necessarily their personal data, so target your searches by relevant subject matter.
What if the DSAR comes with a tribunal claim?
Reasonableness and proportionality are most often questioned when a DSAR comes alongside an Employment Tribunal claim. Here, it can look like an attempt to make the employer show its hand early in proceedings. However, under current ICO guidance, you must still deal with a DSAR, even if some of the information requested may be the same as the requester is entitled to, or which you have already provided, through a statutory process like a tribunal.
Step 7: Review and redact the results.
Some categories of data are exempt from the right of access. In an employment context, these are likely to be the most relevant:
- Management forecasting, particularly in redundancy-related DSARs.
- Records of your intentions in negotiations with the requester, where disclosing them would prejudice those negotiations.
- Legal advice and litigation privilege.
- References given in confidence.
- Information about other people whose rights and freedoms would be harmed by disclosure.
The last point matters most in grievance and disciplinary matters. Witness interviews, statements and allegations may have been given in confidence and in sensitive circumstances. Consider each record carefully. Redact it permanently or, if you can’t protect the third party’s identity, withhold it.
Step 8: Respond and explain.
On or before the deadline, give the requester secure access to the reviewed and redacted data. If you haven’t already sent the Article 15 supplementary information, include it now.
You must also explain which exemptions you’ve applied. Many AI-generated DSAR templates we’ve seen demand this record by record, but that isn’t required. A brief explanation in your covering letter or email is enough.
You don’t have to name an exemption if doing so would undermine the reason for applying it. For example, you may hold records of an intention to negotiate with the requester before any protected conversation has happened. Telling them about that exemption could prejudice any negotiation you later want to start.
Respond in a format that matches the request. Most DSARs arrive electronically and should be answered electronically. Answer postal requests by post, unless you’ve agreed a different format. For verbal or in-person requests, check what the requester expects and what they can access.
Finally, set out your data protection complaints process, which the Data Protection Act 2018 (updated by DUAA) now requires, and tell the requester they can complain to the ICO.
Can you extend the DSAR deadline?
Yes, by up to two further months if the request is complex. You must tell the requester about the extension before the original one-month deadline runs out.
A request isn’t complex just because it covers a lot of data. ICO guidance gives examples of complexity, such as a large amount of exempt data or technical difficulty retrieving data from certain systems.
Can you charge a fee for a DSAR?
Usually not. The £10 fee allowed under the Data Protection Act 1998 no longer exists. You can only charge if:
- The request is manifestly unfounded or manifestly excessive (in which case you could refuse it anyway); or
- The requester asks for further copies of information you’ve already provided.
Any fee must be reasonable and based on your administrative costs. In practice, it would be unusual to charge for a request you’re legally allowed to refuse.
Can you refuse a DSAR?
Only in two situations:
Manifestly unfounded: it must be clear and obvious that the requester has no genuine intention to exercise their right of access. Examples include a malicious request, or one used purely to disrupt an organisation or harass individuals.
Manifestly excessive: the request is clearly or obviously unreasonable when weighed against the burden, cost or repetitive nature of handling it.
Decide each DSAR on its own facts. A large volume of data or an ongoing dispute isn’t enough to refuse. Where the requester is in a dispute with their employer, the ICO wouldn’t consider that they lack a genuine intention to exercise their rights, even if they’ve clearly relied on AI.
If you refuse, explain why. Signpost your own complaints process, the requester’s right to complain to the ICO and their ability to enforce their right through the courts.
How can you prepare for DSARs?
- Train your staff to recognise data subject rights requests, including verbal ones.
- Put processes in place for responding to DSARs and handling data protection complaints, with named team members.
- Keep the ICO’s DSAR guidance to hand. It was updated in July 2026 and helps with decision-making.
- Document everything, including your reasons for refusing a request or scoping a search. The ICO’s main concern is that requests are taken seriously and handled reasonably. Having evidence of your reasoning will help if there’s a complaint.
Received a complex DSAR?
What happens if the requester isn’t happy with your response?
They can complain to you first. Under section 164A of the Data Protection Act 2018, you must have a process for handling complaints. You must acknowledge a complaint within 30 days, investigate it without undue delay and keep the individual updated.
If they’re unhappy with how you handle their complaint, they can take it to the ICO. They don’t have to complain to you first and can go straight to the ICO. The ICO generally encourages both sides to resolve things directly, but it will contact you once it has considered the complaint.
Individuals can also go to court for compensation, or for an order requiring you to provide the data. This is expensive, so complaints to the ICO are far more common.
Common mistakes when responding to a DSAR
- Only treating written requests as DSARs. Train staff to recognise verbal and in-person requests too.
- Starting the clock on the next working day. Count from the day an email arrives, even outside business hours.
- Not acting quickly enough on the request and running out of time.
- Searching by name only. Target searches by subject matter and the key people involved.
- Refusing because a request is long, AI-generated or linked to a dispute. Refuse only if it’s manifestly unfounded or manifestly excessive.
- Extending the deadline too late. Tell the requester before the one-month deadline expires.
- Being unaware of exemptions and providing data which could be lawfully and appropriately withheld.
- Not providing the Article 15 supplementary information.
- Leaving out the complaints information. Signpost your own process and the right to complain to the ICO in every response.
When to speak to a solicitor
While many DSARs can be handled in-house with a clear process, it’s worth taking advice from a solicitor when a request is linked to a dispute, involves sensitive information about other people, or you’re thinking about refusing it.
Speak to a solicitor if:
- The DSAR comes with, or ahead of, an Employment Tribunal claim or grievance.
- You’re considering refusing the request or charging a fee.
- The records include witness statements or other third-party information given in confidence.
- You need to decide whether an exemption applies, such as legal privilege or negotiations.
- You’ve received a complaint, or the ICO has been in touch.
- You don’t yet have a DSAR or complaints process in place.
FAQs
How long do I have to respond to a DSAR?
One month from the day you receive it. You can extend by up to two further months if the request is complex, as long as you tell the requester before the first deadline expires.
Can an employee make a DSAR verbally?
Yes. A DSAR is valid in any format, including verbally or in person. Make sure your staff know how to recognise one and who to pass it to.
Do I have to search every email that mentions an employee?
No. The requester is only entitled to data found by a reasonable and proportionate search, and which is about them rather than their ordinary work activity. Focus on the subject matter and the people involved in relevant decisions, such as their line manager and HR.
Can I charge for a DSAR?
Usually not. You can only charge a reasonable admin fee for further copies, or for a manifestly unfounded or manifestly excessive request.
Can I refuse a DSAR because the employee has made a tribunal claim?
Not on that ground alone. A dispute doesn’t mean the requester lacks a genuine intention to use their right of access. You can, however, consider what the Tribunal disclosure rules will cover when scoping a proportionate search.
About the author
Kate Edwards qualified as a commercial solicitor in 2018 while working in-house for a leading global insurer. Shortly afterwards, she moved into private practice with a large regional firm, focusing on data protection compliance for organisations of all sizes and across a range of sectors, before joining Setfords.
Note: This article is general information about responding to data subject access requests in England and Wales and is not legal advice. The law and timescales can change, and every situation is different, so please speak to a qualified data protection solicitor about your circumstances.
View Profile
Contact our team
Location
Business Hours
