Subject Access Request Procedure and Response Letters

An internal procedure telling your staff exactly how to recognise, log, verify, search for, review and answer a subject access request (SAR), updated for the Data (Use and Access) Act 2025 rules on “reasonable and proportionate” searches and the stop-the-clock period. It includes a SAR log, a search plan and seven template letters.

• Adopt it now as your standard SAR procedure and train anyone who answers post, email, phones or social media
• Use the letters every time someone asks for a copy of their personal data
• Use it for requests from customers, staff, ex-staff, job applicants, tenants, volunteers and members of the public

• Fill in the purple placeholders, especially the named SAR Lead and the systems list in Schedule 2
• Decide your identity-check rules in clause 6 and keep them proportionate
• Delete letter options you will not use and save the letters as separate templates
• Cross-refer to your Data Protection Policy and Data Retention Policy