What is a DSAR?
A data subject access request (DSAR, or SAR) is an individual's request for a copy of the personal data an organisation holds about them. The right is set out in Article 15 of the UK GDPR. It also entitles the person to supporting information: the purposes of processing, the recipients, the retention period, the source of the data, and whether automated decision-making is involved. A request does not have to use the words "subject access" or cite the law. A request can come from a staff member asking a manager "what do you hold on me?", a customer asking for CCTV of their visit to a store, or a customer requesting the notes on their record.
Source: UK GDPR Article 15 · ICO: A guide to subject access
How long do we have to respond to a DSAR?
One month from the day the request is received. The ICO counts the day of receipt as day one, so a request received on 3 March is due by 3 April. If the request is complex, or the same person has made several requests, the period can be extended by up to two further months, but you must tell the individual within the first month that you are extending and why. Extension is a decision to be justified on the facts of that request, not a default; a busy team is not a complex request.
Source: UK GDPR Article 12(3) · ICO: A guide to subject access, "time limit"
Can we "stop the clock" on a DSAR?
Yes, in two situations. First, where you genuinely need to confirm the requester's identity before releasing data, the time limit runs from the day you receive that confirmation. Second, where a request is broad and you reasonably need clarification to find the data, the clock pauses on the day you ask and resumes the day after you receive the answer. The ICO applied this as guidance for years; the Data (Use and Access) Act 2025 placed it on a statutory footing from 5 February 2026. Both are conditional on acting promptly: ask for the identity evidence or the clarification within days of receipt, not in week three. Asking for clarification you do not need, or ignoring an answer, does not pause anything.
Source: ICO: A guide to subject access, "clarifying the request" · Data (Use and Access) Act 2025 s.76
Can we charge a fee for a DSAR?
Not normally. The first copy of the data must be provided without charge. A reasonable fee based on administrative cost is permitted only for further copies of the same data, or where a request is manifestly unfounded or excessive, in which case you may alternatively refuse it. The ICO reads "manifestly excessive" narrowly, and the burden of showing it is on the organisation. A request that is large, inconvenient, or made in the middle of a dispute is not excessive for those reasons alone.
Source: UK GDPR Article 12(5) · Article 15(3)
Do we have to release CCTV footage in response to a DSAR?
Yes, if the individual is identifiable: their image is their personal data. The practical difficulty is other people in the frame. Under Schedule 2, paragraph 16 of the Data Protection Act 2018 you are not obliged to disclose information that identifies another individual unless that person consents or it is reasonable to disclose without consent, so faces, number plates and other identifiers of third parties are normally blurred or otherwise redacted before release. Footage is usually overwritten on a short cycle, so on receipt of a request the first step is to preserve the relevant recording. Refusing because redaction is "too difficult" is not a recognised ground.
Source: DPA 2018 Schedule 2, paragraph 16 · ICO guidance: video surveillance
What can we withhold from a DSAR response?
Only what a specific exemption allows, and each one must be applied to the particular document, not to the request as a whole. Good practice, and what the ICO expects if it investigates, is a written exemptions log recording what was withheld and why.
Source: DPA 2018 Schedule 2 · ICO: A guide to subject access, "exemptions"
Can a solicitor or claims management company make a DSAR for someone else?
Yes. A request can be made through a representative. The organisation needs to be satisfied that the person making the request on behalf of someone else is authorised to do so. Requests that arrive in batches from claims management companies are not excessive merely because there are many of them; each is a separate request from a separate person, with its own deadline, and each mandate should be checked individually.
Source: ICO: A guide to subject access, "requests made on behalf of others"
Do we still have to respond if the person is in a dispute with us?
Yes. The right of access does not depend on the requester's motive. Employment tribunal claimants, ex-employees with grievances and customers in complaints all keep their Article 15 rights. What changes is the care required: litigation-context responses are read by the other side's lawyers, so the search log, redaction schedule and exemptions log need to withstand scrutiny, and legal professional privilege needs to be identified precisely rather than asserted broadly.
Source: UK GDPR Article 15
What happens if we miss the DSAR deadline?
The individual can complain to the ICO, which can issue an enforcement notice, a reprimand or, for serious or repeated failures, a monetary penalty under Article 83. They can also apply to the court for an order compelling compliance. Missing the deadline for one request in a difficult month is recoverable; a pattern of missed or late responses could indicate that the organisation has wider compliance challenges.
Source: DPA 2018 section 167 · ICO enforcement action
What does it cost to have Just DSARS handle a request?
A standard request is £1,500 + VAT, fixed. A complex request is quoted after a scoping call, from £3,000 and capped at £5,000 + VAT, with the cap agreed in writing before we start. Retainer arrangements are available for organisations with high volumes of requests. The fee covers the operational work of fulfilling the request; it does not include legal advice on the merits of a dispute or representing you to the regulator.
Source: Just DSARS published pricing
