A subject access request can come from an employee, former employee, customer or job applicant, and it does not need to use any particular wording or format (ICO, nd). Once received, the clock starts: organisations must respond without undue delay and within one calendar month, extendable by a further two months if the request is complex or repeated, provided the person is told within the first month (ICO, nd). The individual is entitled to confirmation that their data is being processed, a copy of that data, and supplementary information such as why it is held, who it is shared with and how long it is kept (Legislation.gov.uk, nd).
For the individual, a SAR is often about more than curiosity. It can uncover inaccurate records, reveal who information has been shared with, or provide evidence for a grievance, disciplinary appeal, discrimination claim, or employment tribunal. Employees and former employees are among the most frequent users of this right, often turning to it once a workplace relationship has become difficult. Getting a clear, complete and timely response builds confidence that the organisation takes their rights seriously. A slow, incomplete or confusing response can do real damage to that trust, particularly in an employment relationship where the power balance already favours the employer, and it is grounds for a complaint to the ICO.
For the organisation, the picture is more demanding. Every relevant system must be searched, including HR platforms, shared drives, email accounts and even messaging apps, and any third-party information within the results usually has to be identified and redacted before release (ICO, nd). Exemptions exist, for example for legal privilege or where disclosure would seriously harm someone else, but the threshold for relying on them is high, and each one must be justified on its own facts (ICO, nd). The scale of the task should not be underestimated: complaints about the right of access make up the largest single category of data protection complaints the ICO handles each year, and its caseload of unresolved complaints is rising (ICO, 2025). HR teams report a steady increase in requests too, with the searching, reviewing and redacting work described as one of the most resource-intensive parts of the data protection role, and a mishandled request can prove costly once legal advice, management time and remedial work are added up (HR Magazine, nd).
This is where digital working matters. Organisations that store people data across scattered spreadsheets, shared inboxes and paper files struggle to locate everything within the deadline, increasing the risk of an incomplete or late response. A well-structured HR information system, clear data mapping and defined retention rules make it far easier to find, review and redact the right information quickly. Some organisations also use dedicated case-management or redaction tools to track deadlines and manage large volumes of documents consistently. Digital solutions do not remove the need for human judgement, particularly when deciding what to redact or which exemption applies, but they reduce the operational strain and lower the risk of missing the statutory deadline.
Handled well, a SAR is a straightforward exercise in good data governance. Handled badly, it can lead to an ICO complaint, reputational damage and a breakdown of trust with the very people the organisation relies on.
Action Point
Find out how your organisation would search for one person’s data today. Could you locate every system that might hold information about them within a few days, including email, shared drives and any HR platforms? Identify one gap, such as an unmapped data source or an unclear process for redacting third-party information, and raise it with your data protection lead.