Before the Month Runs Out: A Small Business Guide to Subject Access Requests

A subject access request is not a form to be completed or a complaint to be deflected. It is a legal request by an individual for a copy of their personal data. It can be made verbally, by email or through any member of staff, and it does not need to use the words 'subject access request'. For a small business, the practical challenge is to answer properly within a strict one-month period while protecting other people's information.

The One-Month Clock

Under UK GDPR, a business acting as a data controller must respond without undue delay and in any event within one month of receiving the request. One month means a calendar month, not thirty days. If a request is received on 8 November, the response is normally due by 8 December. If the request is complex or the business has received a number of requests from the same person, the period can be extended by up to two further months. The requester must be told within the first month that an extension is being used and why. An extension is not a routine administrative step, and it should not be used to buy time where the request could reasonably be answered sooner.

Step One: Log the Request and Acknowledge It

Any member of staff may receive a request. Small businesses should have a central inbox or named person so that requests are not left in an individual's diary. Record the date of receipt, the identity of the requester, the scope of the request and the format requested. Acknowledge the request promptly. Do not ask why the person wants the data. If the request is genuinely unclear, ask for clarification, but do not allow a request for clarification to become a reason for delay.

Step Two: Verify Identity Proportionately

If there are reasonable doubts about identity, the business can ask for information to verify it. The check should be proportionate. An employee known to the business may need less verification than an unknown customer. Use a secure channel and do not ask for excessive documents such as several forms of identification when one reasonable check would suffice. If a request is made by an agent, such as a solicitor or family member, obtain confirmation that the agent is authorised to act. Record the verification steps taken.

Step Three: Search in a Reasonable and Proportionate Way

Personal data may be held in emails, customer relationship systems, HR files, case notes, spreadsheets, messaging applications and call recordings. Search using the requester's name, known email addresses and relevant dates. The search should be reasonable and proportionate. A small business is not expected to search every backup ever made, but it should search the systems where personal data is likely to be held and document what was searched.

Step Four: Redact Third-Party Data

A subject access request is about the requester's personal data, not anyone else's. Information about other people should not be disclosed unless they have consented or it is reasonable to disclose it without consent. Redaction may be needed for names, contact details, opinions and identifying details. Consider the context. A document should not be withheld in full if the requester's data can be separated from third-party data. Use proper redaction tools and keep an unredacted working copy for the record.

Step Five: Consider Exemptions

Some data may be exempt from disclosure. Common examples include information covered by legal professional privilege, certain information relating to crime or taxation, negotiations, references and some regulatory matters. Exemptions are fact-specific and should not be used simply because disclosure would be embarrassing or inconvenient. If an exemption is relied on, record the reasoning and be prepared to explain it if the requester complains to the Information Commissioner's Office.

Step Six: Prepare the Response

Provide a copy of the personal data in an accessible format. If no personal data is held, say so clearly. Explain any redactions or exemptions in plain English. If an extension has been used, confirm it in writing. Tell the requester about the right to complain to the Information Commissioner's Office. Send the response securely. A password-protected document or a secure portal may be appropriate depending on the sensitivity of the information.

Step Seven: Keep Records and Learn

Keep a record of the date of receipt, the date of response, the searches carried out, the redactions made and any exemption relied on. That record supports accountability and helps if a complaint is made. Review what the request reveals about the business's data retention. If old files are being kept without a clear purpose, that is a separate data protection issue worth addressing.

Common Mistakes to Avoid

Ignoring a verbal request or waiting for a particular form is a common error. So is treating a subject access request as a freedom of information request. Businesses sometimes delay unnecessarily while asking for identification, miss the one-month deadline, disclose third-party data without a lawful basis, redact too much, or charge a fee where none is permitted. A routine request can become a regulatory complaint if it is handled casually.

Davis Solicitors can advise small businesses on data protection policies, subject access request procedures and responses to complex requests.