Genmar IT

How Should a Small Business Handle a Subject Access Request (DSAR)?

James Moore · Managing Director, Genmarapprox. 11 min read

On this page

A subject access request usually arrives at the worst possible time. In our experience it's rarely a curious customer. It's an ex-employee in the middle of a dispute, often with a solicitor behind them, asking for every email that mentions their name.

The legal side of a DSAR is reasonably simple. The hard part is finding the data, working out what you can and can't send, and redacting it, all inside a month. That's an IT problem as much as a legal one, which is why I'm writing this.

What counts as a subject access request?

Anyone whose personal data you hold can ask you for a copy of it. That's the right of access under Article 15 of UK GDPR.

There's no required form or wording. A request doesn't have to say “subject access request”, mention the law, or go to a particular person. An email to a branch manager, a letter to reception or a message on LinkedIn can all count. The clock starts when anyone in the business receives it, not when it reaches the person who deals with it.

So the first fix costs nothing: tell your staff what one looks like and who to forward it to the same day.

How long do I have to respond to a DSAR?

One calendar month, counted from the day you receive it. That day counts, not the day after: a request received on 3 March is due by 3 April. If the deadline falls on a weekend or bank holiday, you have until the next working day. If the next month has no matching date, the deadline is the last day of that month.

The clock starts at the latest of these:

  • the day you receive the request
  • the day you receive any ID you asked for
  • the day you receive payment, if a fee applies
  • for a solicitor or other representative, the day you receive evidence of their authority

Only ask for ID where you genuinely need it, and ask as soon as possible. You can't sit on an ID check for weeks and then rely on it to buy time.

You can extend by up to two further months if the request is complex or the person has sent you several, but you have to tell them within the first month and explain why. “We're busy” isn't a reason.

Since 5 February 2026 the Data (Use and Access) Act has also let you pause the clock, but only where you reasonably require clarification to identify the information they're asking for. The ICO allowed this in guidance before; now it's law. It doesn't cover things like the format they want, and you should ask as soon as you can.

Can I charge for a DSAR, or refuse one?

Normally, no charge. You can charge a reasonable fee for the admin cost if a request is manifestly unfounded or excessive, or if they ask for further copies. The same test lets you refuse a request outright, but the bar is high and the burden is on you to justify it.

If you refuse or don't comply in full, you must tell the person why, and that they can complain to you, complain to the ICO, or enforce their rights through the courts.

Since 19 June 2026, every organisation has had to have a data protection complaints process, whether or not it ever refuses a request. You must make complaints easy to submit, for example with an online form, acknowledge them within 30 days, investigate without undue delay and tell the person the outcome.

How much searching do I actually have to do?

You have to make a reasonable and proportionate search. That used to come from ICO guidance and case law. The Data (Use and Access) Act wrote it into UK GDPR and backdated it to 1 January 2024.

It doesn't mean you can skip a mailbox because it's inconvenient. When judging what's proportionate you can consider the volume of information, how hard it is to search and the circumstances of the request. But you also have to weigh the fundamental nature of the right of access, which pulls the other way. And you have to be able to show why a search would be disproportionate. In practice that means writing down what you searched, how, and why you stopped where you did. If the request ends up with the ICO or in court, that record is your defence.

One more thing: deliberately deleting, altering or hiding information to stop it being disclosed is a criminal offence under section 173 of the Data Protection Act 2018, and it can apply to individuals as well as the organisation. The first prosecution came in 2025, when a care home director was fined after concealing and deleting records requested under a DSAR. From the moment a request arrives, nobody tidies up their inbox.

What do I have to send back?

A copy of their personal data, plus supplementary information:

  • why you’re processing it
  • the categories of data you hold
  • who you’ve shared it with
  • how long you’ll keep it
  • where you got it from, if not from them
  • their other data protection rights
  • their right to complain to you
  • their right to complain to the ICO
  • the safeguards in place if you’ve transferred their data outside the UK
  • whether you use automated decision-making about them and, if so, meaningful information about the logic involved and what it means for them

Most of this should already be in your privacy notice, so reuse it. But many privacy notices were written before June 2026 and don't mention the right to complain to you. Update yours.

On recipients, the ICO now expects you to name them. You can only fall back to “categories of recipients” if naming them is impossible or the request is manifestly unfounded or excessive.

Where does personal data actually hide in a small business?

This is where most SMEs underestimate the job. When we've run DSARs for clients, the data was spread across:

  • The person’s own mailbox, if they’re an employee, and the mailbox of every colleague they emailed or who discussed them
  • Shared mailboxes (accounts@, lettings@, info@)
  • Teams chats and channel messages
  • OneDrive and SharePoint, including HR folders and spreadsheets
  • Your line-of-business system: case management, CRM, HR or property software
  • Call recordings on the phone system
  • WhatsApp and texts on work phones
  • Paper files, if you still keep them

Microsoft 365 covers the first four. The rest you'll have to search separately, and it's worth finding out now whether your other systems can even export one person's data.

How do I search Microsoft 365 for a DSAR?

With eDiscovery in Microsoft Purview. If you're following an older guide, the screens won't match: Microsoft retired the classic Content Search, eDiscovery (Standard) and eDiscovery (Premium) experiences by 31 August 2025. There's now one eDiscovery experience in the Purview portal, old searches live in a single “Content search” case inside it, and which features you see depends on your licences.

The base features cover most DSARs: cases, controlling who can see a case, searching Exchange mailboxes, OneDrive, SharePoint and Teams in one go, holds, and export. The premium features add review sets, tagging, OCR, conversation threading and analytics, and need E5 or a qualifying add-on.

If you're on Business Premium, check what your own tenant shows before relying on anything. Microsoft's own pages contradict each other on the base features: one says case users need E3 or E5, while its small business plan comparison lists eDiscovery with hold and export for Business Premium.

Whatever the answer on the base features, Business Premium doesn't include the premium ones. Microsoft sells two add-ons built for it: Microsoft Purview Suite for Business Premium and Microsoft Defender and Purview Suites for Business Premium. Both require Business Premium and are capped at 300 users. If you're not sure which you need, or whether you need either, we can check your tenant and quote.

One catch: premium features have to be licensed for the people whose data you're analysing, not just the admin running the search. A DSAR sweeps up several colleagues' mailboxes, so price it for everyone in scope. For one or two DSARs a year, the base eDiscovery tools plus a separate redaction tool are usually enough.

The steps we follow:

  1. Create a case using a reference number, not the requester’s name, so their name doesn’t appear in the case list. Limit access to the people handling it.

  2. Put the data on hold. Create a hold policy and add the data sources: the relevant users, groups and sites. Holds can take up to 24 hours to apply. Holding a Team or Microsoft 365 group only covers the group mailbox and site. Teams one-to-one and group chats sit in individual users’ mailboxes, so put the individuals on hold too. Holding first isn’t a legal requirement, but it’s good practice.

  3. Search using the person’s name, nicknames, email addresses, phone number and any staff or client reference, filtered to a sensible date range.

  4. Record your search: the terms, locations and dates. This is your proportionality evidence.

  5. Export the results and start reviewing.

Why does a DSAR take so long?

Redaction. Finding the data is quick once you know how. Reviewing it is where the time goes.

Almost every email in a DSAR mentions other people. You don't have to disclose information that identifies someone else unless they consent or it's reasonable in all the circumstances to disclose it. But you still have to disclose as much as you can without identifying them, which is why redaction is the norm.

Some material may be exempt altogether. In an employment dispute, the exemptions most likely to apply are legally privileged advice from your solicitor, management information such as restructuring plans, records of negotiations with the requester such as settlement discussions, and confidential references. Take advice before relying on one.

Two practical warnings:

  • Highlighting text in black isn't redaction. If the underlying text is still in the PDF, anyone can copy it out. Use a tool that actually removes the text, and check the output.
  • Email threads multiply. The same message can appear in a dozen replies across five mailboxes. De-duplicate before you review or you'll redact the same paragraph twenty times.

This is the part where tooling genuinely saves time. RedactBox, a UK DSAR redaction tool, is one example. It takes the PST export straight out of Purview, as well as PDFs and individual emails. It detects duplicates so each email is redacted once, and when you redact a third party it applies that everywhere they appear while leaving the requester in. It handles attachments, burns the redactions into the exported files and checks the exports so redacted text can't still be showing. It also produces an audit trail and a schedule of redactions, which doubles as your record of what you did.

How can I speed up the DSAR process?

  1. Write a process and name an owner before you need one. Most of the panic comes from working out who does what on day 20.

  2. Log the date received immediately. Your deadline runs from then.

  3. If you genuinely can’t tell what they want, ask straight away. The clock only pauses while you wait for clarification you reasonably need. If they repeat the original request, you still have to make a reasonable search.

  4. Hold first, search second.

  5. Search narrowly and write it down. Specific terms and date ranges, documented, are faster and easier to defend than “everything”.

  6. De-duplicate before review.

  7. Use a proper redaction tool.

  8. Keep less data, and check what your retention policies actually do. Deleting what you no longer need means less to search next time. But Microsoft 365 retention policies can retain as well as delete, and a “keep for seven years” policy increases what you have to search. Once a request arrives, put the relevant locations on hold so automatic deletion doesn’t destroy anything in scope.

  9. Know when to call a solicitor. If the DSAR is part of an employment dispute or a claim, get advice on exemptions before you send anything.

Do I need DSAR software?

You probably don't need an expensive enterprise eDiscovery platform. But a low-cost redaction tool is worth having even for a single DSAR, because redaction is where the time goes.

One check before you upload anything: a cloud redaction tool is a processor of the requester's and third parties' personal data. Read its data processing agreement and check where the data is stored and processed.

What you can't do is wing it. Missing the deadline and over-disclosing someone else's data are both things the ICO takes seriously.

Frequently asked questions

Need help with a DSAR?

If a request has just landed and you're not sure where to start, we can run the Microsoft 365 search and export and get the data into a form you can review quickly.

Let's talk

Sources