A subject access request (SAR) is a legal right under UK GDPR that allows your customers to ask for a copy of the personal data your business holds about them. As an early-stage founder or e-commerce seller, you must respond correctly to avoid compliance problems.
This guide explains the required response timelines, what information must be provided, and straightforward template processes that small teams can follow without dedicated legal support. Following these steps helps protect your business while respecting customer rights.
Understanding Subject Access Requests
A SAR occurs when an individual contacts your business to request access to their personal data. This can come via email, your website contact form, social media, or even a letter. The request does not need to mention GDPR or use specific wording; any clear ask for personal information counts.
Personal data includes names, email addresses, order history, payment details (if stored), delivery addresses, browsing history on your site, and any customer service notes. You must consider all systems where this data may sit, including spreadsheets, email accounts, accounting software, and e-commerce platforms.
Small teams often receive these requests after a customer dispute or when someone wants to understand what marketing data you hold. Treating every request seriously from the start prevents escalation.
Legal Response Timelines
You must respond to a valid SAR without undue delay and within one month of receipt. This period begins on the day you receive the request, regardless of whether it arrives on a weekend or bank holiday. In complex cases, you may extend this by a further two months, but you must inform the requester within the first month and explain why the extension is needed.
If the request is unclear, you can ask for more information to clarify what the person wants. The one-month clock pauses until you receive the clarification. However, you should request clarification promptly rather than use it to delay.
Timelines can change based on guidance from the Information Commissioner's Office, so always check the latest rules on GOV.UK when you receive a request. For most small e-commerce businesses, the standard one-month period applies in the majority of straightforward cases.
What Information Must Be Provided
You are required to provide a copy of the personal data you process about the individual. This includes not only the raw data but also details such as the purposes of processing, the categories of personal data held, who the data has been shared with, and how long you plan to keep it. You must also explain the individual's rights, such as the right to rectification or erasure.
Information should be supplied in a commonly used electronic format unless the requester asks for another method. Avoid sending data in formats the customer cannot easily read. Redact or remove any third-party personal data that would identify someone else before sending the response.
You do not need to provide documents that contain the data if you can compile the relevant information into a clear summary. Focus on being transparent and helpful. Check current ICO guidance on GOV.UK because expectations about format and level of detail can evolve.
Template Process for Small Teams
Establish a simple SAR process before you receive your first request. Create a central email address or shared folder where all staff forward potential SARs immediately. Designate one person, often the founder or operations lead, to log and manage each request.
Use this basic workflow:
- Acknowledge the request within two working days, confirming you have received it and giving an expected response date.
- Verify the requester's identity using reasonable measures such as asking for order reference numbers or matching email addresses with account details. Do not ask for excessive proof that delays the process.
- Search all relevant systems for the individual's data. Keep a log of where you looked and what you found.
- Compile the data, redact third-party information, and prepare a clear covering letter that explains the enclosed information.
- Send the response securely, keeping a record of what was sent and when.
Document each step in a simple spreadsheet that records the request date, acknowledgment date, response date, and any extensions. This record helps demonstrate accountability if the ICO ever becomes involved.
Handling Common Challenges
Small teams frequently face practical difficulties when responding to SARs. Large order histories or customer service logs can create large volumes of data. Focus on the personal data that relates to the individual and summarise repeated information rather than copying every email thread.
Requests that appear to be intended to cause disruption, sometimes called vexatious requests, still require careful handling. You may refuse a request if it is manifestly unfounded or excessive, but you must explain your reasoning and inform the person of their right to complain to the ICO. Such refusals are relatively rare and should be based on clear evidence.
Another common issue is when a customer asks for data held by third-party processors such as payment gateways or marketing tools. You must provide any data you control or can access, and name the third parties so the customer can approach them directly if needed.
Creating a SAR Response Template
A consistent response template saves time and reduces errors. Start with a polite acknowledgment that references the original request date. Explain the steps you have taken to locate their data and confirm the identity verification method used.
Structure the main content with clear headings such as 'Personal data we hold', 'How we use your data', 'Who we share your data with', and 'Your rights'. Attach or embed the exported data in an organised format, for example as a PDF or spreadsheet with explanatory column headings.
End the letter by offering further assistance and providing the ICO contact details if the customer wishes to complain. Keep copies of all outgoing responses for at least two years. Review and update your template each year to reflect any changes in your data processing activities or current ICO guidance on GOV.UK.
Building Good Habits for Compliance
Prevent problems by minimising the personal data you collect and ensuring it is easy to locate. Use consistent customer identifiers across systems so searches are quick. Train everyone who handles customer queries to recognise and escalate potential SARs immediately.
Regularly review your privacy policy and internal data maps so you know exactly where customer information resides. When you add new tools or platforms, note how to export data from them in case of a SAR.
Founders working from shared spaces such as Loomworks can benefit from discussing these processes with other teams to share practical tips. Keeping compliance simple and integrated into daily operations reduces stress when a request arrives.
Frequently asked questions
How long do I have to respond to a subject access request?
You must respond within one month of receiving a valid request. This can be extended by two further months for complex cases, but you must notify the individual within the first month. Always check the latest ICO guidance on GOV.UK as rules can change.
What should I do if the SAR request is unclear?
Ask the individual for clarification about the information they want. The response deadline pauses until you receive sufficient detail. Make the request for clarification promptly and keep records of all correspondence.
Can I charge a fee for handling a subject access request?
You cannot charge a fee for standard SARs. In limited circumstances involving manifestly unfounded or excessive requests you may be able to charge a reasonable fee for administrative costs, but this is rare. Check current GOV.UK guidance before deciding.
What if the customer asks for data held by my payment provider?
Provide any data you control. Inform the requester which third parties process their data and suggest they contact those organisations directly. You are only responsible for data under your direct control or that you can reasonably access.
How do I verify the identity of someone making a SAR?
Use reasonable checks such as matching the email address with an existing customer account or asking for an order number. Avoid requesting excessive personal information that would itself create a new data protection risk. Document the method used.
Related reading: UK Rules for International Data Transfers After Brexit, UK Cookie Consent Rules and How to Comply, When and How to Report a Personal Data Breach. Browse all company admin & legal guides or apply to Loomworks.