Handling data subject requests without missing the deadline

Subject access is the obligation that most reliably exposes whether a privacy programme is real. It has a hard deadline, it spans every system you own, and it cannot be satisfied by policy — only by actually finding the data.

The workflow

1. Recognise it. A request does not need to cite legislation, use the words "subject access", or come through a form. An email to support saying "send me everything you have on me" starts the clock. Train front-line staff to escalate, because the deadline runs from receipt by any part of your organisation.
2. Log it with the date received — you will need to prove timeliness.
3. Verify identity proportionately. Enough to be confident, not so much that you collect more data than you hold. If the requester is authenticated in your product, that may be sufficient. Disclosing to an impostor is itself a breach.
4. Clarify if genuinely needed — permitted where you process a large volume, though it does not always pause the clock. Do not use it as a delaying tactic.
5. Search across production systems, backups where reasonably accessible, email, messaging, ticketing, CRM and any processor holding data for you.
6. Review for third-party data and exemptions.
7. Respond in an intelligible form, with the supplementary information required — purposes, recipients, retention, rights, source.

The step organisations underestimate is the search. Without a way to query across email, tickets and messaging for an identifier, a one-month deadline is not achievable at any volume — and no amount of process design fixes that.

The deadline

One month from receipt, extendable by two further months for complex or numerous requests — but you must tell the requester about the extension, with reasons, within the original month. An extension claimed on day 31 is late.

Third-party data

Records often contain other people — a support thread naming a colleague, an internal note about a complaint. You must not disclose their personal data unless they consent or it is reasonable to do so without consent. In practice: redact, and document the reasoning rather than the redaction alone.

Exemptions that genuinely apply

Legal professional privilege, management forecasting in some regimes, and information that would prejudice an ongoing investigation. Requests can also be refused as manifestly unfounded or excessive — a genuinely narrow test, not a route for requests that are merely inconvenient. Refusals must be explained, with the right to complain.

Where organisations get caught

• The clock started earlier than they realised — a request sitting in a support queue for two weeks.
• Email and chat excluded from the search because they are hard, which is not a defence.
• Processors not asked for data they hold on your behalf.
• Over-verification used to stall, which regulators treat as obstruction.
• Raw database exports sent as the response — not intelligible, and often disclosing other people's data.

One further trap: an access request arriving alongside an employment dispute is still a valid request. Handling it defensively rather than lawfully is a common and expensive mistake.

Key takeaways

• Any wording, any channel, any recipient starts the clock.
• Cross-estate search capability is what makes the deadline achievable.
• Claim the extension inside the first month or it is late.
• Redact third-party data and document the reasoning.