Subject access requests: the employer's guide

When the clock actually starts

This is the part most guidance flattens into "one month from receipt", and it is worth more precision. Article 12A sets the deadline as one month from the relevant time, which is the latest of:

• when you received the request;
• when you received any information you reasonably needed in order to identify what data or processing the request concerns; and
• when any applicable fee was paid.

The extension has a deadline of its own

You may extend by two further months where that is necessary by reason of the complexity of the requests or the number of them. Two conditions come with it:

• You must give notice to the individual before the initial one-month period expires.
• The notice must state the reasons for the delay.

An extension claimed on day 35 is not an extension - it is a missed deadline with an explanation attached. Diarise the notice point, not just the response point.

What has to go in the response

A copy of the personal data being processed, and all of the following:

• the purposes of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipient, including anyone abroad;
• the envisaged storage period, or the criteria used to determine it;
• the rights to rectification, erasure and restriction of processing;
• the right to complain to you under s.164A of the Data Protection Act 2018;
• the right to complain to the Information Commissioner under s.165;
• where the data was not collected from the individual, its source; and
• whether there is automated decision-making including profiling, and if so meaningful information about the logic involved.

Where the request came in electronically, provide it in a commonly used electronic form unless they ask otherwise. A reasonable fee based on administrative costs may be charged for additional copies - not for the first one.

Manifestly unfounded or excessive

Where a request is manifestly unfounded or excessive - in particular because it is repetitive - you may charge a reasonable fee based on administrative costs, or refuse to act. But Article 12 is explicit: the controller bears the burden of demonstrating that character. In practice:

• "It will take a long time" is not the test. Volume alone is what the two-month extension exists for.
• A request made in the middle of a dispute is not unfounded because of its motive. A DSAR does not stop being valid because you can guess why it was sent.
• If you refuse, tell them why, and tell them they can complain to you and to the Commissioner. A silent refusal is the worst of both outcomes.

The practical HR problems

A workable process

1. Log it the day it arrives, whoever received it, and record the date.
2. Confirm identity if you have genuine doubt - and only then.
3. Ask for clarification immediately if the scope is genuinely unclear, and record when the answer comes back.
4. Decide by week two whether you need the extension, and send the notice with reasons if so.
5. Search systematically - systems, email, chat, shared drives, and any personal notebooks used for work.
6. Review for third-party data and redact with a note of why.
7. Send the data plus the nine items above, and keep a copy of exactly what you sent.

The last step matters more than it looks: if the response is later challenged, the question is what you actually disclosed, and a response you cannot reproduce is a response you cannot defend.