Subject Access Request Solicitors for Businesses
A subject access request (SAR or DSAR) is a request by an individual for a copy of the personal data an organisation holds about them, together with information about how it is used; organisations must usually respond within one month.
call 0207 100 2525 to speak to a specialist today. Available 24/7
Adam Bernard Solicitors helps businesses handle subject access requests, prepare SAR procedures and draft the contract terms that make responding easier when data sits with suppliers.
SARs are increasingly used alongside employment disputes and complaints. A late or incomplete response can lead to ICO enforcement, compensation claims and reputational damage, while an over-disclosure can breach other people’s rights.
Call 0207 100 2525 or book a free consultation — via Zoom, Teams, WhatsApp or Skype
What Is the Right of Access?
Under Article 15 of the UK GDPR, individuals have the right to confirmation that their data is being processed, a copy of their personal data and supplementary information such as purposes, recipients and retention periods. See Article 15 of the UK GDPR and the ICO’s guidance on what the right of access is.
How Long Do You Have to Respond to a Subject Access Request?
You must respond without undue delay and within one month of receipt, which can be extended by up to two further months if the request is complex or one of a number of requests. If you need to confirm the requester’s identity or ask for clarification, the time limit can be paused while you wait. In most cases you cannot charge a fee.
Data (Use and Access) Act 2025: What Changed?
Since 5 February 2026, organisations are only required to make reasonable and proportionate searches when responding to a subject access request. This change, introduced by the Data (Use and Access) Act 2025, puts on a statutory footing what was previously guidance, and also clarified the “stop the clock” rules. Organisations should still document their search strategy carefully. From 19 June 2026, organisations must also have a process for individuals to complain about the handling of their data, including SARs.
Exemptions and Redactions
Some information can be withheld or redacted, for example where disclosure would reveal another person’s data without consent, or where legal professional privilege applies. Exemptions are set out in Schedules 2 to 4 of the Data Protection Act 2018. Common examples include:
• Third-party personal data.
• Legal professional privilege.
• Management forecasting and negotiations.
• Confidential references.
• Crime and taxation.
Applying exemptions requires careful judgement and good records of decisions.
Manifestly Unfounded or Excessive Requests
Some information can be withheld or redacted, for example where disclosure would reveal another person’s data without consent, or where legal professional privilege applies. Exemptions are set out in Schedules 2 to 4 of the Data Protection Act 2018. Common examples include:
• Third-party personal data.
• Legal professional privilege.
• Management forecasting and negotiations.
• Confidential references.
• Crime and taxation.
Applying exemptions requires careful judgement and good records of decisions.
Contracts That Support SAR Compliance
Where suppliers hold personal data for you, your contracts must require them to help you respond to SARs on time. Key documents include:
• Data processing agreements obliging processors to assist promptly.
• Data sharing agreements allocating responsibility between controllers.
• An internal SAR procedure within your data protection policies.
• Clear information in your privacy policy on how to make a request.
Subject Access Requests in Employment Disputes
Current and former employees often make SARs during grievances, disciplinary processes or tribunal claims. Responses need to balance disclosure obligations with confidentiality and privilege, and should be coordinated with any wider dispute strategy.
Step-by-Step: Responding to a Subject Access Request
A defensible SAR response follows a consistent process.
Log the request – record the date received and calculate the deadline.
Verify identity – only where there is reasonable doubt, and promptly.
Clarify scope – if you process a large amount of data, you can ask the requester to specify what they want.
Search – carry out reasonable and proportionate searches of relevant systems, emails and paper files, and record what was searched.
Review – identify the requester’s personal data and apply any exemptions.
Redact – remove third-party data where disclosure would not be reasonable.
Respond – provide the data and the supplementary information in a clear, accessible format.
Record – keep a record of decisions in case of a complaint to the ICO.
SARs Received by Your Suppliers
If a supplier that processes data for you receives a SAR, it should pass it to you promptly rather than responding itself. Your data processing agreements should require this, and set short timescales for suppliers to provide data you need to respond.
How Adam Bernard Solicitors Can Help
• Managing complex SAR responses, including searches, redactions and exemptions.
• Drafting SAR procedures and response templates.
Reviewing supplier contracts for SAR assistance obligations through our contract review service.
Call 0207 100 2525 (24/7) or book a free consultation to discuss your contract.
This page is for information only and does not constitute legal advice.
Frequently Asked Questions
How long does a business have to respond to a subject access request?
Can a business charge a fee for a subject access request?
Do we have to search every system for a subject access request?
Can we refuse a subject access request from an employee in a dispute?
What information can be withheld from a SAR response?
Request to book a Free Consultation
Our Clients Share Their Success Stories.
Good service 👍 👌 many thanks for the great service you have provided to us. Our visa got approved just within 2 weeks only because of your hardwork and subject matter expertise. I am very thankful to you
For me, it was the attitude towards the job the lawyers displayed. Totally unmatched. I've been in and out of law firms because of the divorce with my wife and other related issues but Adam Bernard Solicitors was it for me guys. The best!
I want to thank Adam Benard team, they really helped me in my process of purchasing a property, their team are listen and respond to their customers fast. I really love your service, thanks alot.
Adam Bernard team helped me to purchase the best property for the best amount of time for the best money i have . i personally love dealing with them and i thank the team for all the efforts they made to make the task better .
