Subject access requests: what a small business must do and by when

Sooner or later, most businesses that hold customer or staff details receive a letter or email that says something like: "Please send me all the personal data you hold about me." That is a subject access request, often shortened to SAR. It can arrive from a customer, a former employee or someone acting for them, and the clock starts the moment it lands. This guide explains what the Information Commissioner's Office (ICO) says you must do, and how to be ready before one turns up.

What a subject access request is

The ICO describes it as a request for a copy of a person's personal information, plus some supporting detail about how you use it. People have a right to that copy. The request does not need special wording. According to the ICO's guide to subject access, it can be made verbally, in writing or through social media, so a message to your business social media account can count.

Someone can also ask a relative or a solicitor to make the request for them. In that case the ICO says it is the third party's responsibility to provide evidence of their authority, and you must be satisfied they are entitled to act before you respond.

The deadline, and how to count it

You must respond without undue delay, and at the latest within one month of receiving the request. The ICO's detailed guidance on responding sets out how to count that month:

• Start from the actual date you receive the request, even if that is a weekend or bank holiday.
• The deadline is the end of the same date in the following month.
• If that falls on a weekend or public holiday, it moves to the end of the next working day.
• If the same date does not exist next month, use the last day of that month.

The ICO also notes that, for operational purposes, you could adopt a fixed 28 day period so that you always answer within a calendar month. For a small team, that is a simple rule to remember.

The month can start later in some cases. If you need proof of identity, proof of a third party's authority, or (where allowed) a fee, the time limit does not begin until you receive it. So ask promptly. The ICO's advice is to request ID as soon as possible.

Extra time, and pausing the clock

You can extend the deadline by two further months, making three in total, if the request is complex or the same person has made several requests about their rights. Two details matter:

• You must tell the person about the extension, and explain why, within the first month.
• You must be able to show why the request is complex. The ICO says a large volume of information alone does not make a request complex, and needing clarification is not enough either.

If you genuinely need to ask what someone is after, for example because you hold years of emails about them, you can ask for clarification. The clock stops on the day you ask and restarts the day after you receive the reply. The ICO says you should only do this when it is reasonably required, you should ask as early as possible, and you cannot force the person to narrow their request. If they decline, you still have to deal with the request as made.

Proving who is asking

You need to be satisfied that you know who the requester is and that the information relates to them. The ICO asks you to be reasonable and proportionate. If you already have a way of verifying a customer, such as a logged in account, use that. Ask for formal ID only where it is necessary. You do not have to keep copies of ID documents, though the ICO suggests noting which documents were provided, when they were checked and who checked them.

Fees, searches and saying no

As a general rule you cannot charge. A reasonable fee for administrative costs may apply if a request is manifestly unfounded or excessive, or if the person asks for further copies.

On searching, the ICO says you must carry out a reasonable and proportionate search. You do not need to search in ways that are unreasonable or out of proportion to the importance of the information. That matters for a small firm: you are expected to look sensibly in the places personal data is likely to be, not to turn over every device.

Refusing is harder than many owners expect. You can refuse only if an exemption or restriction applies. Manifestly unfounded or excessive requests are one example, but the ICO states there is a high threshold for relying on them. If you do refuse, you must explain why and tell the person about their options to complain to the ICO or go to court.

What to send back

If the request was made electronically, the ICO says to provide the information in a commonly used electronic format unless the person asks otherwise. Whatever method you use, it must be clear, accessible and sent securely. Emailing a spreadsheet of customer data to the wrong address would create a data breach, so check the recipient and consider a protected link or password sent separately.

What changed in 2026

The Data (Use and Access) Act 2025 has been switching on in stages. The ICO's statement says most of the remaining data protection provisions started on 5 February 2026, and that the requirement for organisations to have a complaints procedure was due on 19 June 2026. The same statement says the ICO has published subject access guidance that is ready to use. We covered the complaints change in an earlier post, and it connects directly: if someone is unhappy with how you handled their request, you now need a way to hear that complaint.

The ICO also says its main SAR guidance is written for larger organisations and points small businesses to its small business web hub. If you are a small firm, start there, and use the self service tool the ICO offers for SAR questions.

What people are saying

Looking at the Hacker News search for subject access request stories, the most discussed item by far is a post about a "nightmare letter" under GDPR, with several hundred comments. The mood among founders is mostly worry about being overwhelmed by a request when the team is tiny, alongside plenty of requests for templates and practical help. The anxiety is understandable, but the rules above are manageable if you prepare.

A checklist for this week

• Name one person who owns SARs, and one backup for holidays.
• Write a one page procedure: log the date received, count the deadline, check identity, search, reply.
• List where personal data lives: email, accounting software, booking system, CRM, WhatsApp, paper files, CCTV.
• Check that your website and privacy notice tell people who to contact.
• Keep a simple log of each request, the dates, any clarification you asked for and your reasons for decisions.
• Test it: ask a colleague to request their own data and see how long it takes to gather.

The fewer places your customer data is scattered, the easier all this becomes. If a request would mean hunting through five unconnected tools, that is a sign the systems need tidying, and sometimes process automation can pull records together so a response takes minutes rather than days. Whatever you decide, the practical message from the ICO is consistent: respond on time, be proportionate, keep a record, and explain your decisions.