Question 1

What is a DSAR?

Accepted Answer

A data subject access request (DSAR, or SAR) is an individual's request to see the personal data an organisation holds about them. The right is set out in Article 15 of the UK GDPR. It entitles the person to a copy of their personal data and to supporting information: the purposes of processing, the recipients, the retention period, the source of the data, and whether automated decision-making is involved. A request does not have to use the words "subject access" or cite the law; an email to a line manager asking "what do you hold on me?" is a valid request and the deadline starts when it arrives.

Question 2

How long do we have to respond to a DSAR?

Accepted Answer

One month from the day the request is received, under Article 12(3). The ICO counts the day of receipt as day one, so a request received on 3 March is due by 3 April. If the request is complex, or the same person has made several requests, the period can be extended by up to two further months, but you must tell the individual within the first month that you are extending and why. Extension is a decision to be justified on the facts of that request, not a default; a busy team is not a complex request.

Question 3

Can we "stop the clock" on a DSAR?

Accepted Answer

Yes, in two situations. First, where you genuinely need to confirm the requester's identity before releasing data, the time limit runs from the day you receive that confirmation. Second, where a request is broad and you reasonably need clarification to find the data, the clock pauses on the day you ask and resumes the day after you receive the answer. The ICO applied this as guidance for years; the Data (Use and Access) Act 2025 placed it on a statutory footing from 5 February 2026. Both are conditional on acting promptly: ask for the identity evidence or the clarification within days of receipt, not in week three. Asking for clarification you do not need, or ignoring an answer, does not pause anything.

Question 4

Can we charge a fee for a DSAR?

Accepted Answer

Not normally. The first copy of the data must be provided free of charge. A reasonable fee based on administrative cost is permitted only for further copies of the same data, or where a request is manifestly unfounded or excessive, in which case you may alternatively refuse it. The ICO reads "manifestly excessive" narrowly, and the burden of showing it is on the organisation. A request that is large, inconvenient, or made in the middle of a dispute is not excessive for those reasons alone.

Question 5

What makes a DSAR "complex"?

Accepted Answer

In our practice a request is standard when it concerns one individual and one organisation, the data sits in one system or a single structured search, it produces up to about 500 items after de-duplication, it involves documents only, there is no live dispute behind it, and no substantive exemption analysis is needed beyond routine third-party redaction. A request is complex when any of the following applies: a litigation, grievance or disciplinary context; CCTV, audio or image redaction; a search across several systems or unstructured data, or more than 500 items; special category or criminal offence data at volume; or a genuine exemption question under Schedule 2 of the Data Protection Act 2018. Complexity affects how we price and staff a request; it does not, by itself, justify extending the statutory deadline.

Question 6

Do we have to release CCTV footage in response to a DSAR?

Accepted Answer

Yes, if the individual is identifiable in it: their image is their personal data. The practical difficulty is other people in the frame. Under Schedule 2, paragraph 16 of the Data Protection Act 2018 you are not obliged to disclose information that identifies another individual unless that person consents or it is reasonable to disclose without consent, so faces, number plates and other identifiers of third parties are normally blurred before release. Footage is usually overwritten on a short cycle, so on receipt of a request the first step is to preserve the relevant recording. Refusing because redaction is "too difficult" is not a recognised ground.

Question 7

What can we withhold from a DSAR response?

Accepted Answer

Only what a specific exemption allows, and each one must be applied to the particular document, not to the request as a whole. The exemptions organisations rely on most are set out in Schedule 2 of the Data Protection Act 2018: information subject to legal professional privilege (paragraph 19); management forecasting and planning, where disclosure would prejudice the business (paragraph 22); records of the organisation's intentions in negotiations with the requester (paragraph 23); and confidential references (paragraph 24). Information identifying other people is dealt with under paragraph 16. Good practice, and what the ICO expects if it investigates, is a written exemptions log recording what was withheld and why.

Question 8

Can a solicitor or claims management company make a DSAR for someone else?

Accepted Answer

Yes. A request can be made through a representative, and the organisation must respond to it as if the individual had made it. Before releasing anything, though, you are entitled and expected to satisfy yourself that the representative actually holds the individual's authority: a signed and current letter of authority that covers a subject access request, in the name that matches your records. Requests that arrive in batches from claims management companies are not excessive merely because there are many of them; each is a separate request from a separate person, with its own deadline, and each mandate should be checked individually.

Question 9

Do we still have to respond if the person is in a dispute with us?

Accepted Answer

Yes. The right of access does not depend on the requester's motive. The Court of Appeal confirmed in Dawson-Damer v Taylor Wessing [2017] EWCA Civ 74 that a request made to obtain material for litigation is not, for that reason, improper. Employment tribunal claimants, ex-employees with grievances and customers in complaints all keep their Article 15 rights. What changes is the care required: litigation-context responses are read by the other side's lawyers, so the search log, redaction schedule and exemptions log need to withstand scrutiny, and legal professional privilege needs to be identified precisely rather than asserted broadly.

Question 10

What happens if we miss the DSAR deadline?

Accepted Answer

The individual can complain to the ICO, which can issue an enforcement notice, a reprimand or, for serious or repeated failures, a monetary penalty under Article 83. They can also apply to the court for an order compelling compliance under section 167 of the Data Protection Act 2018, and claim compensation for damage or distress under Article 82. In practice the more immediate cost is in employment tribunals and complaints, where a late or incomplete response is used as evidence that the organisation has something to hide. Missing the deadline for one request in a difficult month is recoverable; a pattern is not.

Question 11

What does it cost to have Just DSARS handle a request?

Accepted Answer

A standard request is £1,500 + VAT, fixed. A complex request is quoted after a free scoping call, from £3,000 and capped at £5,000 + VAT, with the cap agreed in writing before we start. Volume and retainer arrangements are available for organisations with a regular flow of requests. The fee covers the operational work of fulfilling the request: collection specification, review, redaction, exemption analysis and the response pack, with a search log and exemptions log you can defend. It does not include legal advice on the merits of a dispute or representing you to the ICO.

Subject access requests: the questions we are asked most