If you are working out how to respond to a DSAR, start with the deadline: under the UK GDPR you must reply without undue delay and within one month of receipt, extendable by two further months only where the request is complex or you have received several requests from the same person. Within that month you need to confirm the requester’s identity, run a reasonable and proportionate search, apply any exemptions carefully and send a clear, secure response.
A data subject access request (DSAR, or SAR) is the right of access in Article 15 of the UK GDPR. The Data (Use and Access) Act 2025 has changed parts of the process, so the position below reflects ICO guidance as of October 2026.
How to respond to a DSAR: log it on day one
The most common reason DSAR responses go wrong is that nobody notices the request has arrived. Make sure front-line staff, inboxes and any UK representative know to pass requests on immediately.
On receipt, record:
- the date the request was received, even if that was a weekend or holiday
- who made it, and whether they are acting for someone else
- what they have asked for
- the provisional deadline
If it is genuinely unclear whether a message is a subject access request at all, the ICO says the time limit does not start until that is clarified. Do not use this as a reason to delay, though; ask quickly.
Calculating the one-month deadline
The ICO’s rules for counting the month are precise.
- Start date. The month runs from the day you receive the request, even if that day is not a working day.
- End date. It ends at the end of the corresponding date in the next month. A request received on 1 January is due by the end of 1 February.
- Short months. If there is no corresponding date, the last day of that month applies. A request received on 31 January is due by 28 February, or 29 February in a leap year.
- Weekends and holidays. If the deadline falls on a weekend or public holiday, it moves to the end of the next working day.
The ICO also says organisations may adopt a fixed 28-day period for operational purposes, which guarantees a response within a calendar month.
Extending by two months
You can extend the deadline by two further months if the request is complex, or if the same person has made several requests, including other rights requests. The extended period is calculated as three months from the original start date.
You must tell the requester about the extension, and why, within the first month. You also need to be able to show why the request is complex. According to the ICO, a large volume of information does not by itself make a request complex, and neither does the need to obtain information from a processor.
Identity checks: when the clock has not yet started
You must be satisfied about who the requester is and that the information relates to them. The ICO says identity checks should be reasonable and proportionate:
- ask only for what is necessary, and use formal ID documents only where needed
- use verification methods you already have, such as a known email address or account login
- apply stricter checks where a wrong disclosure could cause more harm
- ask for ID as soon as possible
The time limit does not begin until you receive the ID you reasonably asked for. If someone is acting for the requester, they must provide evidence of their authority. You may note what ID was seen, when and by whom, but you do not need to keep copies.
“Stop the clock” and reasonable searches after the DUAA
Two changes under the Data (Use and Access) Act 2025 now shape the response period.
Clarification can pause the deadline
Section 76 of the Act, which deals with time limits for responding to individuals’ requests, came into force on 5 February 2026. It does not apply to requests received before that date. The ICO guidance now explains that you can stop the clock to ask the requester to clarify their request, but only when clarification is reasonably required. A vague request, or holding a large amount of information about the person, are the ICO’s examples.
The clock stops on the day you ask and restarts the day after you receive the reply. The deadline is then extended by the number of days it was paused. Some limits apply:
- blanket requests for clarification are not appropriate
- asking only about the format of the response does not stop the clock
- you cannot force someone to narrow their request
- if there is no reply, the ICO says waiting one month before closing the request is generally reasonable
Only reasonable and proportionate searches
Section 78 of the Act adds a new Article 15(1A) to the UK GDPR. A requester is entitled only to the information you can provide after a reasonable and proportionate search. The section came into force at Royal Assent in June 2025 and is treated as having had effect from 1 January 2024.
This is not a licence to search less than before. If someone refuses to narrow their request, you should still carry out reasonable searches. Document which systems you searched, which search terms you used and why you stopped where you did.
Exemptions, fees and refusals
Some information may be withheld. The exemptions the ICO lists as most likely to apply include:
- information about other people
- legal professional privilege
- crime and taxation
- management information
- negotiations with the requester
- confidential references
- exam scripts and exam marks
Exemptions apply to specific information, not usually to the whole request. Redact carefully and keep a note of each decision and the exemption relied on.
Fees and “manifestly unfounded or excessive” requests
You generally cannot charge a fee. You can charge a reasonable fee for administrative costs if a request is manifestly unfounded or excessive, or for further copies. The ICO stresses that the threshold for “manifestly unfounded or excessive” is high.
If you refuse a request in whole or in part, you must explain why. You must also tell the person they can complain to you, complain to the regulator and seek enforcement through the courts. Since 19 June 2026, the DUAA has required organisations to handle data protection complaints, including acknowledging them within 30 days.
What to send, and how
A response is more than a copy of the data. The requester is also entitled to supplementary information, which largely mirrors what a privacy notice contains, such as purposes, recipients, retention and sources.
On format and delivery, the ICO’s guidance says:
- if the request was made electronically, reply in a commonly used electronic format unless the person asks otherwise
- secure remote access is acceptable if the person can download a copy, but offer another method if they cannot or do not want to use it
- the information must be clear and accessible
- you must take reasonable steps to keep it secure
Sending a DSAR response to the wrong email address is itself a personal data breach, which may need to be handled under the 72 hour breach notification rules. Double-check recipient details before you press send.
For UAE businesses, remember that where the EU GDPR applies to your processing, its own rules govern the response. It also sets a one-month deadline, but the DUAA changes described above do not apply to it. Our guide on whether GDPR applies to UAE companies explains how to tell which regime applies.
What to do next
- Train your front line. Make sure staff and any representative recognise and forward requests the same day.
- Use a deadline calculator. Build in the ICO counting rules, or a fixed 28-day target.
- Verify identity proportionately. Ask for ID promptly and only when you need it.
- Search and document. Record systems, search terms and the reasons for the scope of your search.
- Review exemptions and redactions. Note each decision, and get advice on difficult cases, such as requests made during disputes, through our DSAR response support.
- Send securely. Check the recipient and format before sending.
If you are unsure how to respond to a DSAR in a particular case, PAD International Group can help, whether you are in the UK, the UAE or elsewhere. We support every stage, from triage and search strategy to exemptions and the final response letter. Learn more about our data subject access request service or contact us.
This article is general information, not legal advice for a specific case.
Frequently asked questions
How long do I have to respond to a subject access request?
Without undue delay and within one month of receipt. You can extend by two further months if the request is complex or you have received several requests from the same person, but you must tell the requester within the first month.
When does the one-month period start?
On the day you receive the request, even if it is not a working day. If you reasonably ask for ID, or for a fee where one is allowed, the period starts when you receive it.
Can I stop the clock on a DSAR?
Yes, for requests received on or after 5 February 2026, you can pause the deadline to ask for clarification where it is reasonably required. The clock restarts the day after the requester replies.
Do I have to search every system and email account?
You must carry out a reasonable and proportionate search. The Data (Use and Access) Act 2025 confirms that requesters are entitled only to what such a search finds, but you should document how you searched.
Can I charge for a DSAR?
Generally no. A reasonable administrative fee is allowed only for manifestly unfounded or excessive requests, or for further copies, and the ICO treats that threshold as high.
Sources
- ICO – Right of access: What should we consider when responding to a request?
- ICO – A guide to subject access
- ICO – The DUAA: summary of the changes – data protection
- Data (Use and Access) Act 2025, section 78 – legislation.gov.uk
- The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026
- ICO – One month to go: what businesses need to know to meet new data law (complaints)
- Regulation (EU) 2016/679 (GDPR) – EUR-Lex (Recital 59)
Insights & answers
Latest from PAD