When Someone Asks for Their Data

15/02/2026

What Every Organisation Must Understand About Subject Access Requests in 2026

When someone asks to see the personal data your organisation holds about them, it is not a favour.

It is not discretionary.

It is a statutory right.

Under UK data protection law, now refined by the Data (Use and Access) Act 2025, individuals have a legal right to access their personal data.

And organisations have:

  • A statutory duty to respond
  • A statutory timeframe
  • Minimum legal requirements to meet

This has not changed.

What has changed is the clarification around how you conduct searches.

And that’s where misunderstanding is becoming risky.

A Subject Access Request Is a Legal Obligation

If an individual asks:

  • “What information do you hold about me?”
  • “Please send me my file.”
  • “I want a copy of all emails mentioning me.”

That is almost certainly a Subject Access Request (SAR).

  • You do not need special wording.
  • You do not need a form.
  • You do not need the words “data protection.”

If it’s a request for their personal data, it engages the law.

And the clock starts.

The Deadline Is Real

In most cases, you must respond within one calendar month.

You may extend by a further two months if the request is complex – but you must notify the individual within the first month and explain why. You must be able to justify why on scrutiny from any ICO complaints.

Silence is not compliant.

Delay because “we’re busy” is not compliant.

Waiting until it becomes convenient is not compliant.

What Has the DUAA Changed?

The DUAA clarifies that organisations are required to carry out “reasonable and proportionate searches.”

This is helpful, particularly, for organisations collecting, storing and/or sharing large volumes of client data.

But it does not mean:

  • You can only search one system
  • You can ignore email accounts
  • You can avoid archived data without thought
  • You can provide a summary instead of the actual data

It means your search must be:

  • Thought through
  • Documented
  • Defensible

“Reasonable” is a legal test.
It is not shorthand for “minimal effort.”

The Minimum Requirements Still Apply

When responding to a SAR, you must:

  • Confirm whether you process their personal data
  • Provide a copy of that personal data
  • Explain your lawful basis
  • Outline retention periods
  • Inform them of their rights
  • Explain their right to complain to the Information Commissioner’s Office

Providing a short summary email is not sufficient if fuller data exists.

Filtering out uncomfortable content is unlawful.

Redacting third-party data must be done carefully. Not as a blanket approach.

Where Organisations Commonly Go Wrong

Many smaller organisations, and even some established ones, still:

  • Treat SARs as customer service queries rather than legal obligations
  • Assume employment disputes change the rules
  • Fail to recognise informal requests
  • Miss the statutory deadline
  • Keep no audit trail of search decisions

The risk is not just regulatory.

It is reputational.

In employment disputes and complaints, SAR compliance is often scrutinised line by line.

If You’re Unsure, That’s a Risk Signal

If your organisation cannot confidently answer:

  • Who manages SARs?
  • Where is personal data stored?
  • How are searches scoped?
  • Who signs off responses?
  • How are redactions reviewed?

Then you do not have a defensible SAR process.

The DUAA hasn’t lowered the bar.

It has clarified it.

A Simple Reality Check for 2026

Subject Access Requests are not rare.

They arise in:

  • HR disputes
  • Customer complaints
  • Regulatory investigations
  • Contract terminations
  • Safeguarding matters

If your organisation handles personal data, and every organisation does, SAR readiness is not optional.

It is part of operating lawfully.

Final Thought

The language of “reasonable and proportionate” should provide clarity.

It should not create complacency.

  • A SAR is a statutory right.
  • The deadline is statutory.
  • The minimum content is statutory.

If you are unsure whether your current process would withstand regulatory scrutiny, now is the time to review it – not when a complaint lands.

Leave a comment

  • Cyber security is a data protection issue: lessons from the ICO’s ACRO reprimand

    14-08-2026 The Information Commissioner’s Office (ICO) has reprimanded ACRO Criminal Records Office following cyber security failings which potentially exposed the personal information of up to 10,920 people. The case is a useful reminder for organisations that cyber security is not simply an IT issue. It is a fundamental part of data protection compliance, accountability and…

  • Council officer convicted for unlawfully accessing personal data

    24/07/2026 The Information Commissioner’s Office (ICO) has recently highlighted an important reminder for all organisations that handle personal information: having access to a system does not mean you are entitled to access every record within it. A former Herefordshire Council employee has received a suspended prison sentence after unlawfully accessing approximately 490 personal records and…

  • Why Smart Companies Keep Getting Data Protection Wrong

    12/07/2026 The biggest data protection risk? It’s certainty. The organisations most likely to get into difficulty with data protection are rarely the ones asking difficult questions. They’re the ones convinced they’re already compliant. Whether it’s a multinational or a start-up, the mistakes are remarkably similar: Collecting data because they can, not because they need to.…

  • The Rise of the Cake Shed

    When Home Business CCTV Stops Being “Purely Personal or Household” 05/07/2026 Have you noticed the increase of “cake sheds” in your area? It seems every week another one pops up on local social media groups. Home businesses are booming. Whether it’s a side hustle or the start of something much bigger, garden bakeries, honesty shops,…