Country-specific guidance Current

UK GDPR data subject access requests for client information

What a subject access request actually requires, and by when.

A client asking to see what personal information you hold about them is a formal request with its own clock, whether or not they use the words "subject access request". This guide sets out how to respond. It is general information, not legal or compliance advice.

Action plan

1 Recognise the request, however it's worded A client doesn't need to say "subject access request" for it to be one.

A subject access request (SAR) is any clear request from a client for a copy of the personal information your firm holds about them. Recognise it as soon as it's made and start the response clock from that point, rather than waiting for a more formal-sounding request.

  • Treat any clear request to see held personal information as a SAR
  • Log the date the request was received to track the response deadline accurately
  • Don't wait for a formal-sounding request before starting the response process

Done when: The request has been recognised as a SAR and its response clock started from the date received

ICO: right of access
2 Respond within one month, or extend properly if genuinely complex One month is the default; an extension is available but has its own conditions.

The default timeframe to respond to a SAR is one month from receipt. Where the request is genuinely complex, or your firm has received multiple requests from the individual, the response time can be extended by up to two further months, but this extension isn't automatic and should be applied deliberately, not as a default.

  • Respond within one month of receiving the request as the default
  • Only extend by up to two further months where the request is genuinely complex or numerous
  • Tell the client about any extension and the reason for it, not just silently take longer

Done when: The SAR was responded to within one month, or a genuine, properly-communicated extension was applied

ICO: right of access
3 Pause the clock only when genuinely seeking clarification The response clock can pause while you seek clarification, but this isn't a general delay tool.

Where your firm genuinely needs clarification from the client to identify what they're asking for, the one-month clock pauses from the day clarification is requested and resumes the day after the clarification is received. Use this only when clarification is genuinely needed, not as a way to buy time on requests that are already clear.

  • Only pause the clock when genuine clarification is needed to identify what's being requested
  • Resume the clock the day after the client's clarification is received
  • Don't use a clarification request as a general delay tactic on a clear request

Done when: Any clock pause was genuinely for clarification, correctly resumed, and not used to delay a clear request