Subject access requests: how to answer within one month

A subject access request is a person asking you for the personal data you hold about them. Article 15 of the GDPR, and of the UK GDPR, entitles them to a copy of that data and a short explanation of how you use it, within one month and, in most cases, free of charge.

Requests rarely arrive at a good moment: an employee who has just left, a client disputing an invoice, a prospect who did not enjoy your cold email. No magic words are needed: “send me all the data you have about me” in a reply counts.

This guide is for small teams in the EU and for businesses outside it that deal with people in the EU. It is part of my GDPR guide for small-team businesses.

Who must answer, and who can ask

Anyone whose data you hold can ask: clients, prospects, subscribers, current and former staff. They need no reason and no form: an email, a call or a social media message counts.

The duty falls on the controller, the business that decides why and how the data is used. If you only handle data for a client, as a web agency often does, pass the request on at once and help them answer (Article 28(3)(e)).

Your location changes the regulator more than the rules: the CNIL for a French business, the ICO (formally the Information Commission since 30 September 2026) for a UK one. A Swiss, US or Canadian business that sells to people in the EU is usually covered too, through Article 3(2), as my guide to GDPR outside the EU explains.

What you must send: the copy and eight pieces of information

Your answer has two parts: a copy of the personal data, and the information in Article 15(1) of the GDPR (EUR-Lex), applied to this person:

1. Purposes of the processing.
2. Categories of data: contact details, orders, emails, call notes.
3. Recipients, including your providers, and the safeguards for transfers outside the EU or the UK. People can ask for names, not just categories (Court of Justice of the EU, C-154/21).
4. Retention period, or how you set it.
5. Rights to rectification, erasure, restriction and objection.
6. Complaint: the right to complain to a data protection authority.
7. Source of the data, if it did not come from them.
8. Automated decisions, profiling included, and how they work.

Points 1 to 6 are mostly in your privacy policy already. Point 7 is the one prospecting businesses forget: in December 2024 the CNIL fined KASPR, whose Chrome extension supplies people’s contact details, €240,000 (roughly £200,000), partly because its answers to access requests left out where the data came from (the CNIL’s announcement, in French).

The copy must be complete and intelligible, which can mean extracts or whole documents when the person needs the context (case C-487/21). A request made by email gets an electronic answer, such as a PDF, unless the person asks otherwise (Article 15(3)).

The one-month deadline: counting, extending, pausing

The month runs from the day the request reaches your business, not the day someone notices it: received on 3 March, due by 3 April (Article 12(3)).

Extending. You can add two months for a complex request, or several requests from the same person, if you tell them within the first month and say why. A busy week is not complexity; four years of emails to review may be.

Checking identity. Ask for more information only if you have reasonable doubts about who is asking (Article 12(6)). A request from the address you already use with that client usually needs no ID, and the European Data Protection Board considers a copy of an identity document inappropriate unless strictly necessary (EDPB Guidelines 01/2022). When you do need proof, the UK month starts once you receive it, and the CNIL takes the same view. Ask on day one, not day 29.

Clarifying. If you hold a lot about someone, recital 63 lets you ask which information or dealings they mean. In the UK, Article 12A, added by the Data (Use and Access) Act 2025 and in force since 5 February 2026, makes this a formal “stop the clock”: the deadline pauses on the day you ask and resumes the day after the answer, as the ICO’s guide to subject access explains. The EU text has no such pause.

Fees and refusals. The first copy is free; extra copies can be charged at cost (Article 15(3)). You can charge a reasonable fee or refuse only if a request is manifestly unfounded or excessive, such as the same request every week, and you must prove it (Article 12(5)). The UK kept the same test.

How to answer a subject access request in seven steps

1. Log it the day it arrives and name one person in charge.
2. Acknowledge it, with the date they can expect an answer.
3. Clarify only if you need to, and offer to send everything if they prefer.
4. Search every system for their name, email addresses, phone numbers and customer number:
   • mailboxes, including colleagues’, shared addresses such as contact@ and archives;
   • CRM, cold email and newsletter tools;
   • website forms, orders, customer accounts, invoicing and accounting;
   • shared drives such as Google Drive or OneDrive;
   • WhatsApp Business, Slack or Teams, call logs and recordings, calendars;
   • paper files sorted by name, and backups that hold data found nowhere else.
5. Review and redact. Remove other people’s data where disclosing it would harm their rights (Article 15(4)), without blacking out whole documents. What colleagues wrote about the person, opinions included, is their data too.
6. Write the reply with the copy and the eight points (template below).
7. Send it securely and record it. Check the address twice: sending a file to the wrong person is a personal data breach. Use a password-protected file with the password sent by text, or a share link that expires.

Custom tools count too: the internal app I built for an air conditioning installer to follow prospects, jobs and calls is as much a place to search as a mailbox, and processors such as your CRM provider must help you search theirs. In the UK, the search only has to be “reasonable and proportionate” (in force since 19 June 2025); the EU text sets no such limit.

A reply template you can adapt

Attach or link the files, and keep every heading, even when the answer is “none”.

Subject: Your personal data request (received [date])

Dear [name],

We received your request on [date]. Under Article 15 of the
[UK] GDPR, here is your data and how we use it.

1. Your data: attached [CRM record; 37 emails mentioning you;
   4 invoices], with other people's details removed where needed.
2. Purposes: [our contract with you; accounting records required
   by law; our newsletter, with your consent].
3. Categories: [contact details, orders, emails, call notes].
4. Recipients: [our accountant; our email and CRM providers,
   their country and the safeguard for any transfer abroad].
5. Retention: [client file: X years after our last contract;
   invoices: Y years, as the law requires].
6. Source: [you / your company's website].
7. Automated decisions: none.
8. Your rights: correction, erasure, restriction, objection, and
   a complaint to [the ICO / the CNIL].

If anything is missing or unclear, reply to this email.

[Name], [business], [contact details]

For the retention periods, see my guide to how long to keep client and prospect data.

When the request comes from a former employee or an unhappy client

Many requests come with a dispute in the background, and that is allowed. The person need not say why, and the Court of Justice confirmed in October 2023 that the first copy stays free even when they want it for a claim against you (case C-307/22). Answer on time and in full: a late or patchy reply hands them a second complaint.

You can refuse an abusive request, but the bar is high. In March 2026 the Court ruled that even a first request can be refused as abusive, but only on documented facts about that request; a damages claim in the background is not enough on its own (case C-526/24, Brillen Rottler). The Commission’s Digital Omnibus proposal would make it easier to refuse requests made for purposes other than data protection; as of 19 October 2026 it is still being negotiated and is not law (see my article on the Digital Omnibus).

In the UK, the Data Protection Act 2018 lets you withhold legally privileged material, confidential references and, where disclosure would harm the negotiations, records of your intentions in negotiations with the requester. It also makes it an offence to alter or delete data to stop it being disclosed after a request (section 173).

Route everything through one person, and write internal emails as if the requester will read them one day. After a subject access request, they might.

The other requests: erasure, rectification, objection, portability

The other rights in Articles 16 to 22 have the same one-month deadline and fit the same log.

• Erasure (Article 17): delete data you no longer need, or after consent is withdrawn or an objection you cannot override. Keep what the law or a legal claim requires, such as invoices (Article 17(3)), and tell anyone you shared the data with (Article 19).
• Rectification (Article 16): correct inaccurate data and complete what is missing.
• Objection to direct marketing (Article 21(3)): absolute. Stop at once and keep the address on a suppression list so the next import does not bring it back.
• Portability (Article 20): data the person gave you, processed automatically under consent or a contract, goes back as a machine-readable file such as CSV, or straight to another provider when technically feasible.

Keep a log, and know when to hand it over

A spreadsheet is enough for most small teams, with one row per request, kept while a complaint or claim is still possible:

If the UK GDPR applies to you, since 19 June 2026 you must also offer a way to complain to you about your use of data, such as a form, and acknowledge each complaint within 30 days. My article on the UK’s Data (Use and Access) Act covers the other changes.

This guide is general information, not legal advice. Most requests need no lawyer; one is worth paying for when the request is part of an employment claim or a lawsuit, comes from a solicitor, involves health or other sensitive data, or means reviewing years of emails. If you have a DPO, involve them from day one: people can write to them directly about their rights (Article 38(4)).

If requests reach you every month, automate the dull part: a form or an inbox rule that logs each request, computes the deadline and reminds its owner a week before.