Subject access requests · UK GDPR Article 15
Answer the request. Then prove you answered it properly.
Find everything in scope, redact third-party information consistently, and show your search was reasonable and proportionate — with the reason for every redaction on record.
The clock
One calendar month to respond, extendable by up to two further months for complex or numerous requests.
What the law asks
A subject access request gives a person the right to a copy of their personal data (UK GDPR Article 15). You have one calendar month to respond, extendable by up to two further months for complex or numerous requests. The Data (Use and Access) Act 2025 confirms that the search must be reasonable and proportionate, and lets the clock stop while you wait for information you reasonably need, such as clarification of the request. Information about other people can be withheld where the Data Protection Act 2018 allows (Schedule 2, paragraph 16).
- Deadline
- One calendar month, extendable by up to two further months
- What’s asked
- A copy of the person’s personal data
- The hard part
- Everyone else in it
Where it goes wrong
Officers apply exemptions differently, so similar requests get different answers.
Third-party information is missed, or redacted so heavily the response is useless.
Nobody can show afterwards why the search stopped where it did, and requesters can now complain to you directly.
How Smartbox handles it
Different regimes. The same four steps.
Discover
Collect from mailboxes, file shares and case systems; remove duplicates and thread email; record every source searched.
Decide
Reviewers apply exemptions from a library you control; third-party information is flagged for a decision; every redaction carries its basis and reviewer.
Act
Redactions are burned into the response copy and checked before release.
Prove
The record shows what was searched, what was withheld and why, and when and why the clock stopped.
Bring a real subject access request to a demo.
What you can show afterwards
- Exemptions recorded, not remembered.
- Clocks that hold their own evidence.
- Redactions in the file itself.
Questions
Does Smartbox decide what to redact?
No. It finds and proposes; your reviewers decide, and each decision is recorded with its reason.Can we show our search was reasonable and proportionate?
Yes. The record shows which sources were searched and what was found, alongside the reasons your team records for limiting a search.How is third-party information handled?
It is flagged for a decision, and each decision is recorded with its basis and the reviewer's name.
Related
- GuideThe SAR clock since February 2026: when it starts, stops and restarts
- GuideEvidencing a reasonable and proportionate SAR search
- GuideRedacting other people's information in a subject access request
- Defensible disclosureWhat makes a disclosure defensible
- Other obligationsFOI and EIR, public inquiries, criminal disclosure, health records and civil disclosure
Beta open now · General availability January 2027
Take control of your next case.
Join the Gen 2 beta, or see it working on your kind of material in a 60-minute demo.
