Subject Access Request Help & Support

Received a Subject Access Request (SAR) and not sure what to do next?

CSRB provides practical, expert support to help organisations respond to Subject Access Requests correctly, manage the process and reduce the risk of getting it wrong.

Whether you need some expert guidance while your team handles the request, a detailed review before information is disclosed, or ongoing support throughout a complex SAR, our three support packages give you a clear choice from the outset.

Subject Access Request support from £995 + VAT.

Received a Subject Access Request? You Do Not Have to Handle It Alone

A Subject Access Request can look relatively straightforward when it first lands in your inbox.

Then you start working out what information falls within the request. Where you need to search and what should be disclosed. What should not be disclosed and what needs to be redacted. How you are going to respond. And whether the person making the request is likely to come back asking for more.

It can quickly become a significant job for a business that already has plenty of other things to be getting on with. There is also risk attached to getting it wrong. Missed deadlines, inappropriate disclosure of personal data or mistakes in the way a request is handled can lead to complaints to the Information Commissioners Office (ICO), reputational damage, and unnecessary regulatory scrutiny.

That is particularly true when a Subject Access Request (SAR) comes from a current or former employee and sits alongside a grievance, dismissal or other dispute.

CSRB can provide experienced, independent data protection support at whatever level you need – from advice on how to approach the request through to ongoing support for more complex cases.

Choose the Level of Subject Access Request Support You Need

Not every SAR needs the same level of support. We offer three fixed-price packages so you can choose the level of expert involvement that is right for your organisation and the request you’re dealing with.

£ 995

Expert guidance while your team manages the process.
Initial assessment of the SAR
Advice on scope and legal obligations
Search strategy and practical guidance
Template correspondence and general advice
Your team manages the SAR and disclosure process

£ 3,500

Greater review and assurance before you disclose.
Everything included within Essential, plus:
Review of your search methodology
One comprehensive review of the proposed disclosure pack
Review of redactions and draft response
Final recommendations before disclosure

Popular

£ 7,000

Ongoing expert support throughout the SAR.
Everything included within Professional, plus:
Unlimited advice throughout the lifecycle of the SAR
Unlimited reviews of draft disclosures and correspondence
Drafting of responses where required
Strategy discussions and ongoing support through to completion
Assistance with any ICO enquiries or complaints arising directly from the SAR

All packages exclude manual document redaction, large-scale document review, litigation support and attendance at meetings or hearings unless separately agreed.

Not Sure Which SAR Support Package You Need?

The right package will depend on the nature of the request, how much work your organisation is able to manage internally and how much expert involvement you want along the way.

Professional could be right for you

if the SAR is more involved or sensitive and you want an experienced data protection professional to review your search methodology, proposed disclosure, redactions and response before information is released.

Essential could be right for you

If the request is relatively contained and you have the internal resource to carry out the searches and manage the disclosure, but want expert guidance on your obligations and how to approach it.

Premium could be right for you

If you are dealing with a complex or contentious request and want ongoing expert advice and support throughout the process, including help if the SAR leads to an ICO enquiry or complaint.

If you are unsure, get in touch with CSRB and tell us what you are dealing with.

Why Can Subject Access Requests Become So Complicated?

The principle behind a Subject Access Request is straightforward: individuals have a right to access personal data that an organisation holds about them.

Dealing with that request in practice is not always quite so straightforward.

A SAR can require information to be identified across emails, documents, HR records and other systems. That information then needs to be considered carefully before disclosure, particularly where records contain personal data relating to other people. Decisions may need to be made about what should be disclosed, what should be withheld and what needs to be redacted to avoid exposing somebody else’s personal data.

And sometimes responding to the initial request is not the end of it.

The person making the request may challenge the response, ask whether further information exists or raise concerns about what has or has not been disclosed. In more contentious cases, a SAR can continue to require attention long after the first set of documents has been provided.

That can put considerable pressure on internal teams – particularly when the request is being handled alongside an existing employment or commercial dispute.

Our SAR support packages give you access to experienced data privacy guidance so you do not have to navigate those decisions entirely on your own.

Subject Access Request Support for Employers & HR Teams

Employee and former employee Subject Access Requests can be particularly challenging.

A SAR is often made alongside a grievance, disciplinary matter, dismissal or other employment dispute. That can leave employers dealing with two separate issues at the same time: the employment matter itself and their responsibilities under data protection law.

Your HR adviser or employment specialist can support you with the employment issue.

CSRB can help with the data protection side.

We work with organisations and their HR advisers to provide practical support with employee SARs and DSARs, including advice on the scope of a request, search methodology, disclosure, redactions and responses.

So, if an employee or former employee has submitted a Subject Access Request and your first thought was “What do we need to do with this?”, you are in the right place.

Why Choose CSRB for Subject Access Request Support?

Subject Access Requests are not just an administrative exercise. They involve legal obligations, potentially sensitive personal information and decisions that need to be made carefully.

CSRB provides practical data protection advice from certified and independent data privacy professionals who understand both the regulatory requirements and the realities of running an organisation.

Our support is:

Experienced

You will have access to professionals who deal with data protection issues in the real world, including complex Subject Access Requests.

Practical

We will explain what needs to happen in plain English and give you guidance you can actually use.

Independent

You get objective data privacy advice focused on helping your organisation meet its obligations and manage risk appropriately.

Flexible

Choose the level of support you need rather than committing to an ongoing consultancy arrangement simply because one SAR has landed on your desk.

CSRB’s consultancy services are fully insured, and our data privacy professionals undertake ongoing CPD to keep their knowledge current.

Subject Access Request FAQs

What is a Subject Access Request (SAR)?

A Subject Access Request is a request made by an individual to access personal data an organisation holds about them. You may also see it referred to as a Data Subject Access Request or DSAR. It is known within the UK GDPR as the ‘Right of Access’.

Is a DSAR the same as a Subject Access Request?

Yes. SAR and DSAR are commonly used terms to describe the same type of request. DSAR stands for Data Subject Access Request, while SAR is the shorter term Subject Access Request.

What should I do if I have received a Subject Access Request?

Do not ignore it. You need to understand what the individual is requesting, identify the individual, identify the information your organisation may hold and make sure the request is handled in accordance with your data protection obligations.

If you are unsure how to approach the request, getting specialist advice early can help you understand its scope and what needs to happen next.

How long do we have to respond to a Subject Access Request?

Under UK GDPR, organisations will generally need to respond to a Subject Access Request without undue delay and within one month of receiving it. In certain circumstances, including where a request is complex or an individual has made a number of requests, the response period can be extended by up to a further two months. It is important to establish the applicable deadline and your obligations from the outset.

Can an employee make a Subject Access Request?

Yes. Current employees can make Subject Access Requests for personal data held about them by their employer.

These requests can involve information held across HR files, emails and other business systems, which is one reason employee SARs can become time-consuming to manage.

Can a former employee make a Subject Access Request?

Yes. A former employee can make a Subject Access Request for personal data an organisation continues to hold about them.

Former employee SARs can sometimes arise alongside or following an employment dispute, making it particularly important to consider the data protection request separately and carefully.

Do we have to provide everything someone asks for?

A Subject Access Request relates to a copy of the individual’s personal data rather than automatically entitling them to every document or piece of information they request.

Determining what falls within scope and what should ultimately be disclosed can be one of the more complicated parts of handling a SAR.

Relevant exemptions may also apply in some circumstances, which is another reason disclosure decisions need to be considered carefully.

Can we refuse a Subject Access Request?

There are limited circumstances in which an organisation may be able to refuse to act on a request, including where a request is manifestly unfounded or manifestly excessive. Relevant exemptions may also affect what information needs to be disclosed. These decisions need to be made carefully and should not be based simply on the fact that a request is inconvenient, time-consuming or connected with a wider dispute.

If you believe you may have grounds to refuse a SAR or apply an exemption, specialist advice can help you understand your position before responding.

What information needs to be redacted from a SAR?

Documents identified during a SAR search can contain personal data relating to other individuals or other information that requires consideration before disclosure.

What should be redacted will depend on the information and circumstances involved, so redaction decisions should not simply be treated as a mechanical exercise.

What happens if someone complains to the ICO about our SAR response?

An individual can raise concerns with the Information Commissioner’s Office about how an organisation has handled their Subject Access Request. CSRB’s Premium SAR Support package includes assistance with ICO enquiries or complaints arising directly from the SAR.

Can CSRB manage the whole Subject Access Request for us?

The amount of involvement CSRB provides depends on the package you choose.

Essential is designed for organisations that will manage the SAR and disclosure process internally with expert guidance. Professional adds detailed review and recommendations. Premium provides ongoing advice, reviews, drafting and strategic support throughout the lifecycle of the SAR.

Manual document redaction, large-scale document review, litigation support and attendance at meetings or hearings are excluded unless separately agreed.

How much does Subject Access Request support cost?

CSRB offers three fixed-price levels of Subject Access Request support:

Essential – £995 + VAT
Professional – £3,500 + VAT
Premium – £7,000 + VAT

This gives you clear visibility of the cost and level of support available before you engage us.

Does someone have to say they are making a Subject Access Request?

No. An individual does not necessarily have to use the words “Subject Access Request”, “SAR” or “DSAR” for their request to be valid. If someone asks for access to their personal data, the request may need to be treated as a Subject Access Request even if they have not referred to data protection legislation.

Received a Subject Access Request and Need Help?

You do not need to become a data protection expert just because a SAR has landed in your inbox.

Whether you need guidance on how to handle it, reassurance before you disclose information or ongoing support with a complex request, CSRB can help.

Talk to CSRB about the Subject Access Request you are dealing with and the level of support you need.