A subject access request (SAR) tends to arrive at the worst possible moment. It might be a one-line email from a former employee, a message through your website form from an unhappy customer, or a solicitor's letter quoting Article 15. Whichever it is, the legal clock starts the day it lands, whether or not anyone in the business recognises it as a SAR.
This guide covers how to respond to a subject access request in the UK step by step. It also covers where AI tools can save hours of searching and sorting, and where a human still has to make the call.
What counts as a subject access request in the UK?
The format catches small businesses out more often than anything else. "Can you send me everything you have on file about me" in a Facebook message is a valid request. So is a verbal request made at your front desk. Train everyone who handles customer contact to recognise one and pass it to a named person the same day.
According to the ICO's guide to subject access, the person is entitled to a copy of their personal information plus "other supplementary information". That supplementary information broadly matches what your privacy notice should already say: why you process their data, who you share it with, how long you keep it and where you got it from.
How long do you have to respond to a subject access request?
The ICO guidance sets out three situations where the month starts later: when you are waiting for the person to confirm their identity, waiting for proof that a third party is authorised to act for them, or waiting for a fee in the rare cases where one is allowed. Ask for ID only when you have a genuine doubt about who is asking. A long-standing customer emailing from the address on file rarely needs to send a passport scan.
Put the deadline in a shared calendar the day the request arrives, with a reminder a week before. Most missed deadlines happen because the request sat in one person's inbox.
Can you ask the person to narrow their request?
The ICO explains that the time limit pauses on the day you ask and starts again the day after you receive the reply. That is useful when someone has dealt with you for ten years across three sites and you need to know whether they want everything or just their complaint file.
Keep the question specific and friendly. "To help us get this to you quickly, are you mainly interested in your account records, or in emails about the March 2026 complaint as well?" works better than a demand to justify the request. If they reply "everything", you search everything that a reasonable and proportionate search would cover.
How far do you actually have to search?
Section 78 of the Data (Use and Access) Act 2025 inserted a new paragraph 1A into Article 15. It limits a person's entitlement to the information you can provide after a "reasonable and proportionate search". The ICO had already applied this standard in its guidance, and now it sits in the law itself.
For a typical small business, a proportionate search usually covers:
- Your CRM or customer database
- Shared and individual email inboxes, searched by the person's name, email address and phone number
- Booking, ticketing or job management software
- Accounts and invoicing records
- Messaging apps used for work, including WhatsApp Business
- CCTV, if you hold footage of the person and it is still within your retention period
- Paper files, if you keep them
Write down which systems you searched, which search terms you used and anything you decided not to search, with your reason. That note is your best defence if the requester later complains to the ICO.
Where does AI actually help with a SAR reply?
Here is how the work usually splits in a small business handling a SAR from a former employee whose name appears in a couple of thousand emails:
A practical workflow looks like this. Export the relevant emails from Microsoft 365 or Google Workspace. Use an AI assistant to sort them and flag every message where the requester's personal data appears. Then ask it to list every other named person in those messages. A reviewer works through that list and decides what to redact. Finally, the AI drafts a plain English cover letter that explains what is enclosed, what has been withheld and why, and how to complain to the ICO.
If you already use AI to triage your inbox, the same set-up can flag incoming SARs automatically. Our guide to AI email sorting for business owners covers how to route messages like this to the right person on day one.
Is it safe to put personal data into an AI tool?
The ICO guidance says you must take all reasonable steps to keep information secure while you respond. That applies to every system the data passes through. Before you use AI on a SAR, check four things:
- Whether the provider's business terms let you control or opt out of your data being used for training
- Where the data is stored and processed
- Whether you have a data processing agreement in place
- Whether your privacy notice mentions the provider or the category of processor
Minimise what you share. Often the AI only needs the text of the emails, not the attachments, and it rarely needs bank details or health information to do its sorting job. Our AI data protection checklist for UK businesses works through these checks in more detail.
How do you handle other people's information in the reply?
The ICO points to a three-step process in its detailed guidance for these decisions. The everyday version runs like this. Can you redact the other person's details and still give the requester what is theirs? If not, has the other person consented? If not, is it still reasonable to disclose, considering things like whether the requester already knows the information and any duty of confidence?
AI earns its keep here because it finds every name, phone number and email address across hundreds of pages much faster than a tired manager at 10pm. Make sure your redaction is real, though. Black boxes drawn over a PDF can sometimes be lifted off. Use a redaction tool that removes the underlying text, then open the output file and check it.
Can you refuse a subject access request?
A former employee using a SAR to gather evidence before an employment tribunal is still entitled to their data. So is a customer who is angry about a refund. A request made purely to harass, or the same request repeated every week with nothing new to provide, is more likely to qualify. If you refuse, tell the person why and tell them about their right to complain to the ICO and to go to court.
Disputes like these often begin as complaints. A clear complaint handling process can head off the SAR in the first place, because people tend to ask for their data when they feel ignored.
What should the final reply contain?
A good small business SAR pack usually contains:
- A short cover letter in plain English
- The personal data itself, organised by source (emails, CRM notes, invoices)
- The supplementary information: purposes, recipients, retention, source and the person's rights
- A note of any exemptions applied or redactions made, in general terms
- How to complain to the ICO
The ICO says the response must be "clear and accessible". A 400-page PDF dump with no index technically contains the data but is hard to use. An AI assistant can build a contents page and a one-paragraph summary of each section quickly, and that makes the pack much easier for the requester to follow.
Send the pack securely, for example through a password-protected link with the password sent separately, and log the date you sent it.
How can a small business get ready before the next SAR?
A business that has never had a SAR usually loses the first week working out who deals with it. Fix that now. Pick one person, set up a shared folder with a log template, a cover letter template and your search checklist, and save your privacy notice text somewhere easy to copy. If you plan to use AI for triage and drafting, set up and test the business account before a request arrives, not during one.
If you want help building a Claude-based workflow that sorts, flags and drafts SAR replies inside your own systems, see the guide to using Claude in a UK small business.
Subject Access Request Replies with AI — FAQ
How long do I have to respond to a subject access request in the UK?
ICO guidance says you must respond without undue delay and at the latest within one month of receiving the request. If you need the person to confirm their identity, the month can run from when you receive that confirmation instead. You can extend by up to two further months if the request is complex or the person has made a number of requests, but you must tell them about the extension and explain why within the first month. If you need to clarify what they want, the clock pauses on the day you ask and starts again the day after they reply. Only ask for clarification when you genuinely need it, because the ICO says you cannot force someone to narrow their request.
Can I use AI tools like Claude to handle a subject access request?
Yes, as a helper, not as the decision maker. AI is useful for sorting a large export of emails, tagging which messages mention the requester, drafting the cover letter and flagging names of other people that may need redacting. A trained person still has to decide what gets disclosed, what gets withheld and why. Treat the AI provider as a data processor: use a business account with suitable data terms, avoid pasting whole mailboxes into a free consumer chat, and record which tool you used in your SAR log. The ICO expects you to keep the information secure throughout, and that applies to every system the data passes through, AI included.
Can I charge a fee for a subject access request?
In most cases, no. ICO guidance says you cannot charge a fee for a standard request. You can charge a reasonable fee to cover administrative costs if the request is manifestly unfounded or excessive, or if the person asks for further copies of information you have already sent. If you do ask for a fee, the clock runs from when you receive it, and the ICO suggests it is generally reasonable to close the request if the person does not pay within one month. Be careful with the manifestly unfounded or excessive label. The ICO describes it as a high threshold, so a request that feels annoying or inconvenient will rarely meet it.
Do I have to search every email and file for a subject access request?
No. The Data (Use and Access) Act 2025 inserted a new paragraph into Article 15 of the UK GDPR. It limits the right of access to information you can provide after a reasonable and proportionate search, and the change is treated as having come into force on 1 January 2024. In practice you should search the systems where the person's data is likely to be, such as your CRM, inbox, booking system and accounts software, and write down what you searched and why. You do not need to dig through every old backup if that would be disproportionate to how important the information is. Keep that search record, because it is your evidence if the person complains to the ICO.
What do I do about other people's names in the documents?
ICO guidance says you do not have to disclose information that would reveal another person's information, unless that person consents or it is reasonable to disclose it without their consent. For a small business this usually means redacting colleagues' and other customers' names, contact details and opinions about them, while keeping the requester's own data visible. AI can do a useful first pass by highlighting every name, phone number and email address in a document set. A person should then go through each highlight and decide whether to disclose, withhold or ask for consent. Record the reason for each withholding decision in your log so you can explain it later.
