# Data subject rights and subject access requests

> **Key takeaway:** SAR: any clear request for personal data, answer within 1 month (up to 3 for complex/numerous with notice in month 1), apply DPA 2018 Sch.2 exemptions carefully, redact third-party data. Other rights (rectification, erasure, restriction, portability, objection) are each conditional, not automatic.

- **Jurisdiction:** England & Wales
- **Practice area:** Commercial
- **Last reviewed:** 2026-09-05
- **Interactive page:** https://www.kttclegal.info/library/notes/Commercial/data-subject-rights-and-sars
- **Keywords:** subject access request, SAR, data subject rights, Article 15, right to erasure, right to be forgotten, data portability, right to object, UK GDPR

## What is this about?

Articles 12 to 22 UK GDPR give individuals a set of rights over their personal data, the most frequently exercised being the right of access — the subject access request (SAR). Controllers must respond within strict time limits and can only withhold information under specific, narrow exemptions.

## What is the core rule?

Article 15 gives a data subject the right to obtain confirmation that their data is being processed, a copy of that data, and specified supplementary information (purposes, recipients, retention, and source, among others). Article 12(3) requires a response 'without undue delay and in any event within one month' of receipt, extendable by a further two months for complex or numerous requests if the data subject is told within the first month. Other Chapter III rights include rectification (Art 16), erasure / 'right to be forgotten' (Art 17), restriction of processing (Art 18), data portability (Art 20), and objection (Art 21), each with its own trigger conditions and exemptions. DPA 2018 Sch.2 and related provisions create specific exemptions (e.g. legal professional privilege, management forecasting, negotiations) that can justify withholding some or all of the requested data.

## What are the elements or test?

1. Has a valid SAR been made (any form, to any part of the organisation, does not need to name the legislation)?
2. Identify the responsible controller and confirm identity of the requester where reasonably necessary
3. Search all relevant systems for personal data about the requester
4. Apply any applicable exemption (e.g. third-party data, legal privilege, management information) before disclosure
5. Respond within one month, or up to three months for complex/numerous requests with notice given within the first month
6. For other rights (erasure, rectification, portability, objection): confirm the specific trigger condition and applicable exemption for that right applies before acting

## Which authorities matter?

- **UK GDPR, Art 15** — Establishes the right of access and what must be provided in response to a SAR.
- **UK GDPR, Art 12(3)** — Sets the one-month response deadline, extendable by two further months for complex or numerous requests.
- **Data Protection Act 2018, Sch.2** — Provides UK-specific exemptions from some or all of the Art 15 disclosure obligation, including legal professional privilege and certain management/negotiation contexts.
- **UK GDPR, Arts 16-21** — The remaining Chapter III rights: rectification, erasure, restriction, portability, and objection.

## How does this apply in practice?

This note covers the framework and the SAR time limits specifically; it does not catalogue every DPA 2018 Sch.2 exemption in detail, and does not address SARs made in the context of ongoing litigation disclosure (a distinct, overlapping regime). Redaction of third-party personal data within a SAR response is a common and fact-sensitive exercise not developed here. Fees can no longer be charged for a standard SAR save in limited 'manifestly unfounded or excessive' circumstances under Art 12(5).

## What are common pitfalls?

- Missing the one-month deadline because the request was not recognised as a SAR (it need not use the words 'subject access request')
- Failing to extend the deadline properly — the two-month extension requires notice to the data subject within the original one-month period
- Disclosing third-party personal data embedded in the requester's records without considering redaction or the third party's own rights
- Charging a fee for a routine SAR where the Art 12(5) threshold for 'manifestly unfounded or excessive' is not met
- Overlooking that erasure and objection rights are qualified, not absolute — the controller may have grounds to refuse

## When would a practitioner use this?

Central to any dispute over an individual's access to their own data, employment records disputes, and complaints escalated to the ICO for delayed or incomplete SAR responses.

## Quick reference

SAR: any clear request for personal data, answer within 1 month (up to 3 for complex/numerous with notice in month 1), apply DPA 2018 Sch.2 exemptions carefully, redact third-party data. Other rights (rectification, erasure, restriction, portability, objection) are each conditional, not automatic.

---

*Reference material from [KTTC Legal](https://www.kttclegal.info/), not legal advice. Work product supports instructing solicitors and barristers under their supervision. England & Wales.*