UK Subject Access Request
Under the the UK GDPR, any individual can ask to see what personal data you hold about them – As a business you are required to respond within strict time limits. A SAR can come in many different forms from a verbal request, an email as seen here or as a formal request via solicitor.
Failure to respond correctly or on time can lead to:
Complaints to the ICO
Enforcement notices and fines
Loss of trust from customers or employees
Reputational damage
A SAR can be complicated and time consuming, in some circumstances they can be extensive and stressful to complete too. This is where I can assist.
There have been some changes to the UK GDPR legislation. The new Digital (Use and Access) Act (DUAA) received Royal assent on 19th June 2025 and is being slowly implemented.
What does this mean for your business?
Subject Access Requests:
The DUAA clarifies that organisations are only required to conduct reasonable and proportionate searches when responding to access requests. Organisations are not required to conduct exhaustive or disproportionate searches they must justify the scope of their search based on context and available resources. Timing remains unchanged (1 month), but the DUAA confirms:
“The deadline may be extended by up to two months if the request is complex or multiple requests are received, the data subject must be informed within the first month if an extension is used, and the reason must be explained”.
– Reformed DSAR timeframes and scope
– Safeguards for research-related processing
– Clarification of recognised legitimate interests
– New rules for automated decision-making (“ADM”)
– Cookie compliance exemptions for low-risk analytics
– Updated rules for international data transfers
– Reinforcement of children’s data protection under data protection by design.