What should we consider when responding to a request?

In more detail

• How long do we have to comply?
• How do we calculate a month?
• Can we extend the time for a response?
• When is a request complex?
• Can we clarify the request?
• What do we need to think about if we ask for clarification?
• Can we charge a fee?
• Do we need to make reasonable adjustments for disabled people
• Can we ask for ID?
• What if the person mentions other rights?
• How should we deal with bulk requests?
• Do we still need to comply if the person dies before we respond?

How long do we have to comply?

You must comply with a SAR without undue delay and at the latest within one month of receipt of the request or within one month of receipt of:

• any information you request to confirm the identity of the person the information is about (see Can we ask for ID?);
• any information you request to confirm that the third party is authorised to act on behalf of the person; or
• a fee (only in certain circumstances – see Can we charge a fee?)

How do we calculate a month?

To calculate a month, you must start from the actual date you receive the request, fee or other requested information and count forward to the end of the same date in the following month. Even if you receive the request on a non-working day, you must start from this date.

If the date for responding falls on a weekend or is a public holiday, the deadline moves to the end of the next working day.

If the same date doesn’t exist in the following month (because it’s shorter), use the last day of that month instead.

This means that the exact number of days you have to comply with a request varies, depending on the month in which you receive the request.

If you need to specify a consistent number of days (eg for operational or system purposes), you could adopt a 28-day period to ensure that you always comply within a calendar month.

Can we extend the time for a response?

Yes. You can extend the time to respond by a further two months if:

• the request is complex; or
• you have received a number of requests from the same person. This can include other types of requests about their rights – for example, if a person has made a SAR, a request for erasure and a request for data portability at the same time.

You must calculate the extension as three months from the original start date.

You must let the person know that you are extending the time limit within one month of receipt of the request or within one month of receipt of:

• any information you request to confirm the identity of the person the information is about (see Can we ask for ID?);
• any information you request to confirm that the third party is authorised to act on behalf of the person; or
• a fee (only in certain circumstances — see Can we charge a fee?).

When is a request complex?

You should consider your specific circumstances and the particular request when determining whether a request is complex. What may be complex for one organisation may not be for another. For example, the size and resources of your organisation are likely to be relevant factors.

You must be able to show why a request is complex in the particular circumstances. The following are examples of factors that may, in some situations, add to the complexity of a request:

• Experiencing technical difficulties with retrieving the information (eg if information is electronically archived).
• Applying an exemption that involves large volumes of particularly sensitive information.
• Clarifying potential issues around disclosing information about a child to a legal guardian.
• Requiring specialist work to obtain the information or communicate it in an intelligible form.
• Clarifying potential confidentiality issues around disclosing sensitive medical information to an authorised third party.
• Needing to obtain specialist legal advice (however, if you routinely obtain legal advice, it’s unlikely to be complex).
• Searching large volumes of unstructured manual records — only applicable to public authorities.

If a person requests a large volume of information, this may add to the complexity of the request. However, a request is not automatically complex because it involves a large amount of information.

A request is not complex just because you have to rely on a processor to provide the information you need to respond.

Can we clarify the request?

Yes. You can ask for further information to help you identify the personal information or the processing activity that the SAR relates to.

However, you should not ask for clarification on a blanket basis. You should only ask if it’s reasonably required.

The legislation does not define what is reasonably required. However, it’s likely to refer to circumstances where you are unable to provide an effective response to the SAR until you have received clarification. For example, this may be the case if the request is vague or you hold a lot of information about the person.

If you do ask for clarification, the time limit pauses on the day you request clarification and resumes on the day you receive it. This is referred to as ‘stopping the clock’.

This means that you don’t need to provide the person with a copy of the information until they clarify their request. This includes any supplementary information that you can’t reasonably provide.

You are not required to seek clarification, and you may choose to perform a reasonable search instead. See What efforts should we make to find information?

What do we need to think about if we ask for clarification?

Given the importance of the right of access, you should be able to justify why it’s reasonable for you to ask for clarification before you can identify the information that has been requested.

For example, it may be reasonable for you to ask for clarification if:

• you hold a large amount of information about the person; or
• the request is unclear.

You are responsible for justifying that you will need to search through a large amount of information to deal with a SAR. It’s unlikely to be reasonable or necessary to ask for clarification if you can locate, retrieve and provide information about the person quickly and easily — even if you hold a large amount of information about them.

Whether you hold a large amount of information about a person will, to an extent, depend on your organisation’s size and available resources:

• A big organisation may not consider a request to be high volume if it has significant resources for performing searches.
• A smaller organisation with fewer and less sophisticated resources at its disposal may be more able to argue that it holds a large amount of information.

Another factor to consider is whether, because of its volume, you are unlikely to be able to locate and retrieve all the requested information by performing a reasonable search.

If you need clarification, you can ask the requester to provide additional details, such as the context in which you are likely to hold their information and the relevant dates.

However, you cannot force a person to narrow the scope of their request, as they are entitled to ask for all their information. If the person responds to you and either repeats their request or refuses to provide any additional information, you should still comply with their request by making reasonable searches.

Even if you’re seeking clarification, you can often still provide some information, although this depends on the circumstances.

For example, in many cases, you can confirm that you hold information about the person. In addition, you will likely be able to provide some of the supplementary information, including details of:

• their right to request rectification, erasure or restriction, or to object to processing;
• their right to complain to the controller; and
• their right to make a complaint to the ICO.

If you can reasonably provide any of the supplementary information without clarification, you must provide it within one month of receipt of the request. If your privacy notice already contains this supplementary information, you could provide the person with a link to it.

You should ensure the process of seeking and obtaining clarification is quick and easy for the requester. When asking for clarification, you should:

• provide advice and assistance to help them clarify their request;
• explain that the clock stops from the date that you request clarification and will resume once they respond; and
• specify if they need to reply by a certain time.

Where possible, you should contact the person in the same format they made the request. For example, if they emailed the SAR, you should email them to ask for clarification.

If you receive a request where it is genuinely unclear whether a person is making a SAR, the time limit does not begin until you have clarified:

• if the person is making a SAR; and
• what personal information they are requesting.

You should contact the person as soon as possible (eg by phone or email where this is appropriate). If you talk to the person, you should keep a record of:

• any conversation you have with them about the scope of their request; and
• the date(s) when you request and receive any further explanation.

In all circumstances, you should explain to the person why you are seeking further details and be able to justify your position to the ICO, if asked to.

When you ask for clarification, the timescale for responding will stop until the person clarifies their request and will resume on the date you receive that clarification. You should calculate the timescale as follows:  

• When you receive a request, calculate when the response would normally be due. See How long do we have to comply?
• If you have requested clarification, you may extend this time limit by the number of days that you stopped the clock.

You should ask for clarification as soon as possible after receiving the SAR. This will enable you to search for the information the person wants at the earliest possible stage and ensure that you have enough time to respond.

If it only becomes apparent after starting a search that you need further information to respond to the SAR, you should be able to explain why it was not possible to request clarification earlier. You should record your reasons.

If you ask for clarification and receive it on the same day, the clock does not stop. You should calculate any extension to the time limit in terms of days, not hours.

The clock only stops if you are seeking clarification about the information requested. It does not apply if you ask for clarification on any other matter — for example, the format of the response.

If you seek clarification but do not receive a response, you should wait for a reasonable period of time before considering the request closed. While one month is generally reasonable, you should adopt a proportionate and reasoned approach. If you believe that a person might have difficulty in providing additional details within a specified timeframe, you should try and accommodate the person as much as possible — for example, where there are complex issues or accessibility considerations.

If you need to request clarification and proof of ID, you should do both as soon as possible. It’s unreasonable to wait until the person gives clarification before asking for ID, unless there is a risk of disclosing personal information to the person before you have checked their identity.

You can extend the time limit by two months if the request is complex or the person has made a number of requests (see Can we extend the time for a response?). However, a request is not complex just because you need to seek clarification. See When is a request complex?

Can we charge a fee?

In most cases, you cannot charge a fee to comply with a SAR.

However, you can charge a ‘reasonable fee’ for the administrative costs of complying with a request if:

• it is manifestly unfounded or excessive; or
• a person requests further copies of their information following a request.

Alternatively, you can refuse to comply with a manifestly unfounded or excessive request. See Exemptions: when can we consider a request to be manifestly unfounded or excessive?

When determining a reasonable fee, you can consider the administrative costs of:

• assessing whether or not you are processing the information;
• locating, retrieving and extracting the information;
• providing a copy of the information; and
• communicating the response to the person, including contacting them to tell them that you hold the requested information (even if you are not going to provide it).

As there may be substantial overlap across these activities, you should ensure that the fee is reasonable and that you do not double-charge the person. For example, you may locate, retrieve and extract the information in one action, depending on the context in which you hold the information and how you search for it.

A reasonable fee may include the costs of:

• photocopying, printing, postage and any other costs involved in transferring the information to the requester (eg the costs of making the information available remotely on an online platform);
• equipment and supplies (eg discs, envelopes or USB devices); and
• staff time.

You should base the costs of staff time on the estimated time it will take staff to comply with the specific request, charged at a reasonable hourly rate. Section 12(1) of the DPA allows for the Secretary of State to specify limits on the fees that organisations may charge to deal with a manifestly unfounded or excessive request by way of regulations. However, at present, there are no regulations in place.

You should ensure that you charge fees in a reasonable, proportionate and consistent manner. Therefore, you could establish an unbiased set of criteria for charging fees that explains:

• the circumstances in which you charge a fee;
• your standard charges (including a costs breakdown where possible, eg the cost per A4 photocopy); and
• how you calculate the fee — explaining the costs you take into account, including staff time.

Your criteria should be clear, concise and accessible. You should make these criteria available on request. You don’t need to publish them online.

When requesting a fee, you should explain the costs to the person. You should include a copy of the criteria in your request for a fee and explain any charge that is unclear (see Do we need to explain the information we supply?).

You should be able to justify the costs you have charged if a person complains to the ICO.

If you choose to charge a fee, you don’t need to comply with the SAR until you have received the fee. You should request the fee as soon as possible and, at the latest, within one month of receiving the SAR. The longer it takes for you to ask for a fee, the less likely it is that this is reasonable. It’s unreasonable to ask for a fee as a way of extending the period of time you have to respond to the request.

You should record the reasons for any delay in requesting a fee and be able to provide your reasons to the ICO, if asked.

You should allow the person a reasonable period of time to respond to your request for a fee. It’s generally reasonable to close the request if you do not receive a response within one month, although this also depends on the circumstances.

Do we need to make reasonable adjustments for disabled people?

You may need to make reasonable adjustments to ensure a disabled person can make a request.

What is a reasonable adjustment will depend on the person’s specific needs. If you are aware that a person may require reasonable adjustments (eg they have told you what they need, or they have explained that they are disabled), you should communicate with them (eg by speaking to them) to find out how best to meet their needs before you respond to their SAR. For example, an adjustment may include providing the response in a particular format that is accessible to the person, such as large print, audio, email or Braille.

Your use of personal information must be lawful. As well as data protection requirements, you also need to consider whether you have obligations under other legislation.

Further information about how to make effective reasonable adjustments is available from the Equality and Human Rights Commission or from the Equality Commission for Northern Ireland.

Can we ask for ID?

Yes. To avoid personal information about one person being sent to someone else, either accidentally or as a result of deception, you need to be satisfied that:

• you know the requester’s identity (or the person the request is made on behalf of); and
• the information you hold relates to the person in question (eg when a person has similar identifying details to someone else).

You can ask for enough information to judge if the requester (or the person the request is made on behalf of) is the person whom the information is about.

You should be reasonable and proportionate about what you ask for. Only request formal identification documents if necessary. You can use verification measures that you already have in place (eg an existing username and password).

If the requester’s identity is obvious to you, you are unlikely to require more information. This particularly applies when you have an ongoing relationship with the person.

If you have any doubts about the requester’s identity, it’s reasonable to ask them to verify their identity before sending the information.

How you receive the SAR might affect your decision about whether you need to confirm the requester’s identity.

The level of checks you make may depend on the nature of the information and on the possible harm and distress that an inappropriate disclosure may cause to the person concerned.

You will sometimes need to request more information than usual to verify a person’s identity – for example, where you hold records about different people with the same name.

The timescale for responding to a SAR does not begin until you have received the requested information. However, it’s important to avoid delays. Therefore, you should request ID documents as soon as possible.

If the requested ID information is not sufficient and you need to take further steps to verify the person’s identity, you can do so. The timescale for responding to the SAR resumes once you have completed the verification. However, further requests for verification are only likely to be necessary in exceptional circumstances. See How long do we have to comply?.

The ID documents may not be sufficient if:

• the person supplies information which raises doubts about their identity; or
• you have reasonable concerns that the ID is fraudulent or that the person has obtained it fraudulently.

While you do not need to keep copies of ID documents, you could keep a note of:

• what ID documents the person provided;
• the date you verified them; and
• who in your organisation verified them.

What if the person mentions other rights?

If you receive several requests from a person about other rights (eg the right to erasure and the right to data portability) at the same time as a SAR, you should deal with each request separately. However, certain steps may apply to all the requests, such as (where relevant):

• establishing proof of ID; and
• ensuring that a third party has authority to act on behalf of the person.

In these circumstances, you may be able to extend the time limit to respond by up to two months. See Can we extend the time for a response?.

How should we deal with bulk requests?

Depending on the size of your organisation and the nature of your business, you may receive multiple SARs in a short period of time. For example, in the financial services sector it is not uncommon for claims management companies to make bulk requests on behalf of multiple people. We refer to these here as bulk requests.

Although receiving bulk requests requires more resources, you must respond to each SAR made on a person’s behalf.

Remember the following principles when dealing with high volumes of SARs:

• A SAR made as part of a bulk request has the same legal status as one person making a SAR.
• The person’s reason for making a SAR is not relevant to whether their request is valid (except if you are considering applying the manifestly unfounded or excessive provisions).
• If a third party makes a request on behalf of a person, you should treat the SAR as if the person themselves had made the request. This means that you cannot take into account other requests made by the representative on behalf of other people.
• You need to satisfy yourself that the third party is authorised to make the request.
• You need to satisfy yourself as to the identity of the person concerned.
• Even if you hold no information about the person, you must respond to the request and tell them this.

Do we still need to comply if the person dies before we respond?

No. The definition of personal information only applies to a living person. If you receive a SAR but are aware that the person has died before you have provided your response, you don’t have to respond to the request. If you receive a SAR from a person who was authorised to act on behalf of the deceased person when they were alive (eg a relative, a solicitor or someone who has power of attorney), you are not required to respond after the person has died. A person cannot make a SAR to access information about a deceased person, even if they previously acted on their behalf.

For circumstances where information about a deceased person is contained within the requester’s personal information, see How do we deal with information that relates to the requester and a deceased person?