One month. That's the law's time limit for answering a subject access request, unless an extension applies.
The request itself can be a single sentence from a former employee, asking for all the personal data you hold about them. If you've never had one, you may not have a process ready, or know what you have to send.
It won't always arrive in writing, either. A request can be made verbally or in writing, including by phone or in person.
Take it in this order:
- Log it and work out your deadline.
- Check who's asking.
- Search where their data is kept.
- Check for other people's details, and redact where the law allows.
- Send it with a cover letter.
The kit has a guide to each of those steps, six letters to adapt and a deadline tracker. No data protection team? The kit is built for UK small businesses, sole traders, charities and clubs in that spot.
The rules come from Articles 12 and 15 of the UK GDPR, as amended by the Data (Use and Access) Act 2025. That includes the "reasonable and proportionate" search rule and the "stop the clock" rule for requests received on or after 5 February 2026.
£29 · digital download (ZIP file).
Who it's for
- UK small business owners, sole traders, charities and clubs who've just received a subject access request
- Employers handling a request from a current or former member of staff
- Anyone handling their first request without a data protection team
Working through a request
- Click Get the kit and check out. You'll receive a download link after payment.
- Open the guide and log the request in the tracker.
- Work through the steps in order, using the letters as you go.
- Search, redact and send your response with the cover letter.
Everything happens on your side. You won't need to speak to us.
What's inside
- Step-by-step guide (PDF): what counts as a request, ID checks, deadlines, extensions, "stop the clock" and fees
- Where-to-look checklist: email, shared drives, HR files, messaging apps, CCTV, paper records and more, with suggested search terms
- Redaction basics: when you can remove other people's details, and how to redact a PDF so the words can't be copied back out
- Common exemptions, explained, each with an "if in doubt, ask" note
- Six letter templates (Word): acknowledgement, ID request, clarification ("stop the clock"), extension, response cover letter, and refusal or fee
- SAR log and deadline tracker (Excel): works out the deadline, the latest date for an extension notice and the days left, with tabs to record your search and your redactions
- One-page "what not to do" (PDF)
- Sources list at the end of the guide: the legislation.gov.uk pages the kit is based on, to check each step against
FAQ
How long do I have to respond?
The law says without undue delay, and within one month. The month starts from the latest of when you get the request, any ID you asked for, or any fee. You can extend by two further months in some cases. The guide and tracker explain how.
Do I have to search every email and WhatsApp?
The law asks for a reasonable and proportionate search. The guide explains what that means. It includes a checklist and a record of where you looked.
Can I take out other people's names?
Sometimes. The law lets you hold back information about other people in some cases. The guide explains the factors and how to redact safely.
Can I charge a fee?
Not usually. The law lets you charge a reasonable fee, based on your administrative costs, in two cases. One is for further copies the person asks for. The other is where a request is manifestly unfounded or excessive, and then you can refuse instead. Otherwise you can't charge. The guide explains this and includes a letter to use after advice.
Is a subject access request the same as a data protection complaint?
No. They follow different rules. For complaints, see our Data Protection Complaints Pack.
What formats are the files?
PDF, Word (.docx) and Excel (.xlsx). They open in Microsoft Office, Google Docs and Sheets, LibreOffice and most PDF readers.
Who made this kit
Secordit Intelligence was set up in February 2026 by Matthew Protheroe-Hill, its director. Before that, he co-founded Sencode Cyber Security and was a director there from 2019 to 2023. Qualification: BSc (Hons) Cyber Security & Networks (1st Class), Teesside University.
Law and good practice, clearly labelled
Each step is marked as either what the law says or our own suggestion. You can see what's required and what's simply helpful.
Honest scope
This kit is practical help, not legal advice. Using it doesn't on its own mean your business meets the law. That depends on how you handle each request. If a request is part of a dispute, or you're thinking of refusing or holding information back, speak to a solicitor or data protection specialist. The kit doesn't give advice on employment disputes.
Everything in the download
A ZIP with 9 files: the step-by-step guide (PDF), six letter templates (Word), the SAR log and deadline tracker (Excel) and the one-page "what not to do" (PDF).
Delivery
Digital download (ZIP file). You'll receive a download link after payment.
First thing after download: log the request in the tracker, so the deadline is worked out for you.