Handling a subject access request: deadlines, search and where DOCNUS fits

A data subject access request (DSAR, or SAR) is a request from a person to see the personal data an organisation holds about them. Under the UK GDPR the right of access is set out in Article 15, and the ICO publishes detailed guidance on the right of access. This page summarises the timing rules as they stand in October 2026, then walks through a practical workflow and shows honestly where DOCNUS helps and where it does not. For a short definition, see What is a DSAR?.

The deadline: one month

You must respond without undue delay and within one month of receipt. The ICO explains how to count the month:

• The day you receive the request counts as day 1, even if it is not a working day.
• The deadline is the same date in the following month.
• If there is no such date in the following month, the deadline is the last day of that month.
• If the deadline falls on a weekend or bank holiday, you have until the next working day.

Worked examples

Extending the deadline

You can extend by up to two further months if the request is complex or the person has made several requests. You must tell them within the first month and explain why.

What changed under the Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 made two changes that matter for subject access.

A "reasonable and proportionate search"

Section 78 inserts a new Article 15(1A) into the UK GDPR. The person is entitled only to the information the controller is able to provide "based on a reasonable and proportionate search". The change is treated as having been in force from 1 January 2024.

This does not lower the bar to zero. It means your search needs to be one you can explain and defend: which systems and document stores you looked in, how, and why that was proportionate. Writing that down as you go is good practice.

When the clock starts, and stopping it

Section 76 adds Article 12A, the "applicable time period". It came into force on 5 February 2026 under SI 2026/82. In summary:

• The month runs from the latest of: receipt of the request, receipt of any identity information you asked for, or payment of a fee (where one is chargeable).
• The two-month extension is kept.
• You can "stop the clock" while you reasonably need information from the requester to identify the data or processing the request concerns. The clock is paused while you wait for that information.

Only pause for genuine clarification of what information is wanted. Asking for clarification is not a way to buy time on a request that is already clear.

Fees

A subject access request is normally free. The ICO explains that you may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive (Article 12(5)). You may also charge a reasonable fee for further copies.

A practical workflow

The steps below are a general outline, not legal advice. Each step says whether DOCNUS is involved.

1. Log the request (outside DOCNUS)

Record the date of receipt, who made the request, and how. Work out the deadline using the rules above. DOCNUS has no DSAR case management, request tracking or per-request deadline clock, so use your own tracker or case system.

2. Confirm identity and scope (outside DOCNUS)

If you genuinely need identity information or clarification, ask promptly. Under Article 12A the clock starts from when you receive what you asked for.

3. Search your documents (where DOCNUS helps)

This is usually the slowest part, and it is where DOCNUS is useful if the relevant documents are in your DOCNUS library.

• Entity search. Search the knowledge graph for the person's name, using the type-ahead and the Person filter.
• Entity profile. The person's profile lists up to 100 documents and 20 passages that mention them, along with aliases and, on Professional and above, connections to other people, organisations and agreements. Check the aliases. Near-identical spellings are never auto-merged for people, so "Jon Smith" and "John Smith" may appear as separate entries.
• Chat with cited pages. Ask questions such as "Which letters mention Jane Doe's grievance?" or "Where is Jane Doe's salary discussed?". Each answer cites the file and page, so you can open and check every source. See AI document search.
• Privacy assessment. On Professional and Enterprise, privacy assessment shows which documents hold personal data and what kind (health, employment, contact details and so on), with masked values and page numbers. This helps you spot documents with sensitive categories that need careful handling.

Know the limits of this step:

• DOCNUS only searches documents uploaded to it. Email, HR systems, databases and other stores need searching separately.
• There is no "find this exact identifier across every document" feature, such as searching for one person's National Insurance number.
• Privacy assessment findings are not linked to graph entities, so the assessment tells you a document contains a name or a health detail, not that it is about the requester.
• Results need human review. No automated search finds everything.

Our blog post on how to search documents for a subject access request goes into search technique in more detail.

4. Review what you found (outside DOCNUS)

Read each document. Decide what is the requester's personal data, what relates to other people, and whether anything should be withheld. Take advice where the position is unclear.

5. Redact and compile (outside DOCNUS)

DOCNUS does not redact documents and does not export a person's documents. Use your own redaction tool and prepare the response pack separately.

6. Respond and keep a record (outside DOCNUS)

Send the response with the supporting information the requester is entitled to. Keep a record of what you searched, what you found and what you disclosed, which also supports the "reasonable and proportionate" position if it is ever challenged.

Download the checklist

We have put the steps above, including the deadline rules, into a DSAR checklist (PDF) you can keep next to your tracker.

Where to go next

The ICO's right of access guidance is the authoritative source, and the government's commencement overview tracks when each part of the 2025 Act took effect. If your search step is the bottleneck, you can try DOCNUS on the Free plan, then upgrade to Professional for privacy assessment. See pricing.