How to Deal with a Subject Access Request (SAR)
Pinggg…, an email notification. Promotion? Pay rise? Perhaps Mary finally unjammed the scanner?
Nope, it’s a SAR request from “Tom Smith”, a former employee, and it just landed on you.
It doesn’t matter why, legally you can’t ask why, nor can you refuse to do the SAR, but you must deal with it, promptly.
Relax, we got this. In this 5-minute “how to deal with a subject access request” guide, we will cover how to deal with a SAR request, without any tantrums using a spoon of common sense and a pinch of experience.
Please note, this guide and the advice within are based on how to deal with a standard subject access request. It does not cover situations involving child safeguarding, or an ongoing legal or police investigation – these require separate, specialist advice.
Dealing with a SAR comes in two parts, the gathering of the “relevant” documents, also known as “the scope”, followed by the redaction phase. The first part completely dictates the cost of the second. If this compact guide can cut the document pile in half, then it’s worth a 5-minute read surely?
SAR Response Time
You have just received a subject access request from “Tom Smith” and now have 1 calendar month to respond, not 30 days, not 4 weeks, 1 calendar month!
Example:
• Received 1st January, due 1st February, 31 days.
• Received 31st January, due 28th February (unless a leap year), 28 days.
That’s right folks, as per the law, depending on when you receive the SAR request depends on how long you have to deal with it, clear as mud…(1)
Step One: Acknowledging Receipt of the SAR Request
Firstly, a reasonably strong coffee, followed by an email to “Tom” and acknowledge the receipt of the SAR request, email exactly as below:
“Hi Tom,
We have received your SAR request and will respond within one calendar month, as required by law.”
This sets a clear paper trail for the one-month deadline. The clock is now ticking, and as mentioned before, you have 1 calendar month to respond. Next, study the SAR request. Is it overwhelming? Can it be done in time? If you think you need more time, email “Tom” exactly as below:
“Hi Tom,
Can you please clarify what information you want?
To help us locate the relevant data, please let us know specific dates, topics or departments your request relates to.
Please note that our statutory response timeframe is paused while we wait for your reply.
If we do not hear back from you, we will assume you no longer wish to proceed, and we will close your request.”
By requesting a specific time period, this simple email to “Tom” brings two positives:
- It narrows the search by date period, thereby reduces time and cost (2)
- It pauses the clock, giving more time to gather the relevant documentation (3)
The clock has now paused on the day you asked for the clarification and won’t resume until you get a response. This can give extra crucial days for you to get the relevant data.
As soon as you receive the clarification response, the clock resumes on the day after. If “Tom” doesn’t respond within a reasonable time, you can treat the request as closed.
If “Tom” responds, “I want everything you hold on me”, then you must fulfil the request by executing a reasonable and proportionate search. (4)
Can I Request a Further SAR Extension?
Can be extended by up to two further months (three months total) if the request is unusually complex. You must inform “Tom” within the first month if you need this extension.
But what counts as complex?
Good question, often asked. In the SAR request, amongst the usual, “Tom” has also decided to include the following:
- Telephone records, call recordings and voice messages relating to me.
- Audio recordings, video recordings and CCTV footage where I appear or am discussed.
- Any records held on mobile phones or personal devices.
This is a classic “scattergun” template designed to overwhelm an employer. If your SAR includes any of these requests, a two-month extension can be wholly justified.
ICO guidance on this type of request:
Extracting data from personal devices or private WhatsApp accounts, reviewing call recordings, and reviewing CCTV footage typically requires specialised software or external agencies. The ICO Right of Access Guidance confirms that “specialist work to obtain or communicate information” is valid grounds for an extension. (5)
A word on what “complex” actually means:
3,000 emails certainly feels overwhelming, but volume alone isn’t the test. If you have the resources to process that volume internally (even if it takes a while), it’s not necessarily “complex” in the legal sense.
Genuine complexity comes from needing capability you don’t have in-house – extracting data from personal devices, decrypting old backups, isolating and redacting voices on CCTV or call recordings. This requires specialist software or even outsourcing to external agencies.
That’s the kind of “specialist work” as per the ICO’s guidance for an extension.
To be blunt: “but we have 3,000 emails to get through”, is no excuse.
How to Gather “Relevant” Emails For a SAR:
Outlook’s search bar is more powerful than most people realise. A few simple search operators can cut your email volume significantly before you even start the redaction process.
Basic search:
Typing Tom Smith into the search bar searches the subject line, body content and sender/recipient fields – too broad, not a good starting point, avoid at all costs.
The problem with from/to/cc:
Searching – from:Tom Smith, to:Tom Smith or cc:Tom Smith will return every single email he’s ever sent or received – regardless of whether the content actually concerns him. For anyone who’s worked at a company for years, this can mean thousands of completely non relevant emails.
The fix – search the content, not just the headers:
body:”Tom Smith” – use quotation marks to search for the exact phrase in the email body. This returns all emails containing Tom Smith, please note this will not return any emails containing just Tom or Mr Smith etc.
Without quotes, body:Tom Smith searches for both “Tom” and “Smith” anywhere in the email body. This returns all emails containing Tom or Smith within the email body. Please note it will also return Tom Jones or Jack Smith etc.
subject:”Tom Smith” – This returns subject lines containing Tom Smith only.
Without quotes, subject:Tom Smith – This returns all emails with subject lines containing Tom or Smith.
Quotation marks keep the search precise, use wisely.
Also search by first name alone:
Colleagues often refer to people informally – “Tom said he’d have it done by Friday.” A search for body:”Tom Smith” won’t catch this due to the quotation marks. Running a broader search on body:Tom can help catch these informal mentions, though it will return more results to review, such as Tom Jones etc.
Search scope matters:
By default, Outlook may only search your current folder or inbox. Change the search scope to “All Mailboxes” or “All Folders” to make sure you’re not missing emails filed away in subfolders, archives or shared mailboxes.
Narrow by date (if applicable):
If the SAR relates to a specific time period, which you asked “Tom” in the email we already told you to send. You did ask, didn’t you? Didn’t you?
Use Outlook’s date filter to restrict the search to the relevant dates. This is one of the fastest ways to reduce volume and redaction cost, particularly for long-serving employees with years of email history.
To summarise, just because “Tom” is the recipient of an email does not mean the whole content of the email is their personal information. (6)
A word of caution: Searches aren’t perfect:
Name-based searching is a good starting point, but it has a real limitation – it can’t catch emails that discuss “Tom” without using his name. A message like “He’s been underperforming again this month” won’t appear in a search for “Tom Smith,” even though it may well be personal data about him if the context makes clear who’s being discussed.
This is where the people who know the business add real value over a keyword search – HR, line managers or whoever handled the situation, may recall specific threads or conversations worth checking manually, even if they don’t contain his name.
You don’t need to read every email in the company “just in case” – but if you’re aware of a specific conversation or dispute involving the requester, it’s worth checking those threads even where a name search comes up empty.
Email attachments, leave them out:
Very Important: For faster processing and lower costs, please keep any standalone documents such as PDFs or Word files separately, rather than embedded within email files. Email attachments frequently contain documents completely unrelated to the subject (company reports, circulars, marketing materials, how to unjam a scanner for dummies) which add unnecessary volume and cost.
When exporting from Outlook, uncheck attachments as you really don’t want to be handing over any sensitive documents.
If an attachment is genuinely relevant (see below), add it to the scope separately rather than leaving it buried inside the email export.
How to Deal with Standalone Documents:
For files stored outside of email – HR files, project folders etc – use this simple test:
Include it if:
The filename or document content specifically mentions “Tom Smith”
It sits in a folder or system where his personal records would logically be (his HR file, a disciplinary record, a project he’s individually named on)
Exclude it if:
It’s a general company document he merely had access to or worked on, but isn’t about him personally (a team project plan, a general policy document, a company-wide spreadsheet where he’s just one of many names in a list)
What about documents that are only partly about him?
This is where most of the genuine confusion happens. A set of meeting minutes covering five agenda items – budget, new hires, a client complaint, holiday requests and a disciplinary note about “Tom” – isn’t his document, but one section clearly concerns him.
In cases like this, don’t exclude the whole document, and don’t include it wholesale either. If a 10-page PDF only has one page relating to “Tom”, remove the other nine and disclose the relevant page on its own. Any other individuals mentioned on that page still need the usual third-party redaction.
What about an Excel file with 1,000 rows of employee’s personal information?
Simple,
- Make a copy of the Excel file
- In the copy, delete all rows except the rows containing “Tom’s” details
- Turn off version history (very important) and save
- Provide this “sanitised” version
This way there are no redactions whatsoever and zero danger of disclosing any third-party information.
Does an Employer Have to Disclose Every Telephone Record/Recording?
Our former employee “Tom” cannot use a SAR to fish through thousands of routine customer calls that have nothing to do with their employment relationship. Under UK data protection rules, an employer is only required to carry out a reasonable and proportionate search. (4)
Most if not all day-to-day workplace calls are never recorded in the first place:
- Informal verbal warnings – a manager calling “Tom” on a personal mobile or direct office line to give an informal reprimand.
- Welfare and sickness check-ins – HR or a line manager calling “Tom’s” personal mobile while he’s off sick.
- Return-to-work prep calls – a quick touch-base over Teams or mobile before “Tom” returns to the floor.
- Ad-hoc performance feedback – a supervisor calling “Tom” on a direct, unrecorded extension straight after a difficult customer call.
If any of these happened on an unrecorded line – a manager’s personal mobile, an unlogged direct extension – no data exists to disclose. An employer cannot disclose data it simply doesn’t have.
“If” the call was recorded, the same relevance test applies as anywhere else in this guide: was that specific call about the matter “Tom” is raising a grievance over (e.g. a possible call where he was dismissed), or was it a routine, unrelated call? Only the dismissal call needs disclosing – and even then, only after removing anything relating to third parties.
Does an Employer Have to Disclose All CCTV Footage?
Short answer: No
A SAR request involving the disclosure of an employer’s CCTV footage is relatively simple, the keyword yet again is, you guessed it… “Relevant”.
A Subject Access Request (SAR) is not an automatic entitlement to every frame of footage an employer holds. An employer is only obligated to provide footage where the individual is identifiable and more importantly, where fulfilling the request is “reasonable and proportionate.” (4)
“Tom” got dismissed from his supermarket job. “Tom” has asked for CCTV footage that identifies him. If 40 cameras captured “Tom” simply walking through aisles doing his job over three years, those raw files do not automatically become disclosable unless they directly relate to a specific event, incident or decision involving him.
An employer is not expected to review, blur and export thousands of hours of footage. If a request requires disproportionate effort relative to the context, the employer can ask “Tom” to narrow the scope (e.g., specific date) or refuse the request as manifestly unreasonable or excessive.
If “Tom” was dismissed for theft, an assault on a colleague or customer, as seen on CCTV, then yes, this footage of the incident must be released. However, any footage that shows a third party, e.g. another person, must be blurred before disclosing to “Tom”. (7)
The “Why do you want this?” Trap
Legally under UK GDPR, you cannot ask “why” they want the CCTV footage, but you can ask what specific incident or purpose they are trying to evidence.
There is a fine line here, however we have added “incident or event” in the below explainer to technically try and get more information from “Tom”.
Practical Guidance for the Employer:
- Clarify the Scope: “To help us locate any footage containing your personal data, could you please specify the exact date, approximate time window and specific camera locations relating to the incident or event you are querying?”
- Identify Incidents: The employer only needs to locate and process clips tied to specific events (e.g., the alleged theft or a specific disciplinary workplace incident).
- Exemptions: If footage has already been routinely overwritten under the company’s retention schedule (e.g., 30-day auto-delete), the company simply confirms the footage no longer exists. They are not required to recover deleted data.
The SAR Triage Guide: How to Reduce Your Redaction Costs
Subject Access Requests don’t mean handing over every document or spreadsheet in your company. Many employers disclose far more than legally required, increasing costs and exposing sensitive business information unnecessarily.
Our SAR Triage Guide helps you identify what is actually personal data requiring disclosure versus routine business records that can be excluded. Follow these practical filters to reduce your document pile, protect company information and significantly lower your redaction costs.
Once You’ve Gathered Your SAR Documents
Be under no illusion, dealing with a subject access request can be a really daunting task, but hopefully this guide has given you the confidence to deal with it without too much fuss. Remember the keyword “relevant”, it will keep you in good stead.
Lastly, congratulations if you made it this far. You will now have a much smaller, more relevant set of files than the “download everything” approach. Once you’re ready, we can handle the rest – secure redaction, metadata removal and compliant delivery. Now go help Mary with the scanner!
Transparent SAR redaction pricing from £300
Email: hello@excelnexus.co.uk
Phone: 0161 513 2735
Professional SAR redaction services for organisations that need certainty, not software. Send us your files, we handle the SAR redactions and you receive GDPR compliant, secure documents—it really is that simple…