We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUKDSAR Workflow

UK GDPR DSAR Workflow

Recognise a subject access request in any channel, calculate the Article 12A deadline, run a reasonable and proportionate search, and give the personal data and required information unless a specific restriction applies.

Use this guide for implementation planning, not as a substitute for checking the consolidated UK GDPR, applicable Data Protection Act 2018 provisions, current ICO guidance, contracts, and the facts of the processing.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 27, 2026
Sections
3

Structured answer sets in this page tree.

Primary sources
6

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 27, 2026
Overview

This workflow implements under the UK GDPR as amended through 5 February 2026. It starts the Article 12A clock from the latest permitted trigger, supports a documented clarification pause where further information is reasonably required to identify the information or processing sought, and records the now stated in Article 15(1A).

Section 1

How should a DSAR Workflow run under the UK GDPR?

Log any request that, in substance, asks whether the controller processes the person's data or seeks access to it. Route verbal, social-media, customer-support, and employee requests as well as formal written requests. Confirm an agent's authority and request extra identity information only when the controller has reasonable doubts; use data proportionate to that doubt.

Article 12A sets one month beginning with the latest of receipt, receipt of necessary identity information, or payment of a permitted fee. The controller may extend by two further months when complexity or the number of requests makes that necessary, but must notify the person within the first month and give reasons.

For an Article 15 request, the controller may ask for information it reasonably requires to identify the information or processing activities sought. The period from asking until receiving that clarification does not count. Ask only where clarification is needed for an effective response; the controller cannot force the person to narrow the request, and a workable request should proceed without a routine pause.

A limits unreasonable or disproportionate search effort; it is not a general exemption from the right. Search the sources reasonably likely to contain responsive personal data, record why excluded sources were disproportionate to the importance of the information, and do not substitute a document count for analysis of the requester's personal data.

Requests about a child require a competence, authority, best-interests, welfare, and privacy assessment. A competent child can exercise the right or authorise a representative. Parental responsibility does not automatically entitle an adult to all of a child's information, and the applicable position can differ across the UK.

  • Intake owner: preserve the request, channel, receipt time, requester details, authority to act, requested format, accessibility needs, and all correspondence.
  • Deadline owner: calculate the , any identity or fee trigger, a justified clarification pause, extension notice, and final due date.
  • Search owners: search locations reasonably likely to hold responsive personal data and record systems, accounts, date ranges, custodians, processors, queries, and results.
  • Reviewer: separate the requester's personal data from whole documents, protect other people's rights and freedoms, and apply each exemption only to the material it covers.
  • Reviewer: disclose another person's information only where that person consents or it is reasonable without consent; document the case-specific balance rather than applying a blanket third-party redaction rule.
  • Response owner: provide confirmation, a copy of responsive personal data, the Article 15 supplementary information, explanations for withheld material or refusal, and the controller-complaint, ICO-complaint, and judicial-remedy routes where required. Use a commonly used electronic format for an electronic request unless the person asks otherwise, and deliver it securely and accessibly.
  • Complaint owner: for a data-protection complaint received on or after 19 June 2026, acknowledge it within 30 days, investigate and provide progress without undue delay, and communicate the outcome without undue delay.
Sources for this answer
ICO guide to subject access requests
ICO guidance confirms the right of access and the practical response duties that a UK GDPR DSAR workflow must route.
ICO guidance on responding to a right of access request
ICO guidance supports the workflow steps for clarification, refusal handling, explanations, and review evidence.
UK GDPR Article 15 - Right of access by the data subject
Article 15 is the binding UK GDPR source for the access right that the DSAR workflow operationalizes.
Consolidated UK GDPR Articles 12, 12A and 15
Binding current text for the applicable time period, identity delay, clarification pause, extension, response duties, and reasonable and proportionate search.
ICO guidance on refusing a subject access request
ICO refusal guidance supports documenting exemptions, manifestly unfounded or excessive requests, and reviewer approval in the DSAR record.
ICO guidance on data protection complaints
Current ICO guidance supports the controller-complaint route, 30-day acknowledgement, investigation, progress updates, and outcome requirements in force from 19 June 2026.
Section 2

What fields should the DSAR Workflow template capture?

The case record should show that the controller responded to the actual request on time and based the disclosure on a . It should also make every pause, extension, fee, refusal, exemption, and redaction reviewable.

  • Request and clock: original wording, channel, receipt, , identity doubt and evidence, fee status, clarification request and receipt, extension notice, and due date.
  • Scope and search: confirmed scope, products, systems, processors, custodians, accounts, dates, search method, search owner, results, and quality check.
  • Review: personal-data analysis, duplicate handling, third-party material, confidentiality, exemptions and provisions, redactions, withheld categories, and legal review.
  • Response: data and supplementary information supplied, format and accessibility, secure delivery, refusal or limitation reasons, fee, response time, complaint and remedy information, and delivery evidence.
  • Child or representative request: competence, best interests, parental responsibility or other authority, the person's wishes, third-party evidence, decision, and reviewer.
Sources for this answer
ICO guide to subject access requests
ICO guidance confirms the right of access and the practical response duties that a UK GDPR DSAR workflow must route.
ICO guidance on responding to a right of access request
ICO guidance supports the workflow steps for clarification, refusal handling, explanations, and review evidence.
UK GDPR Article 15 - Right of access by the data subject
Article 15 is the binding UK GDPR source for the access right that the DSAR workflow operationalizes.
Consolidated UK GDPR Articles 12, 12A and 15
Binding current text for the case-record timing, clarification, response, and search fields.
ICO guidance on refusing a subject access request
ICO refusal guidance supports documenting exemptions, manifestly unfounded or excessive requests, and reviewer approval in the DSAR record.
ICO guidance on data protection complaints
Current regulator guidance for complaint acknowledgement, investigation, progress, and outcome fields.
Section 3

How should teams review and improve the DSAR Workflow?

Review the workflow after missed or extended deadlines, complaints, overturned exemptions, repeated clarification, failed identity checks, new systems, processor changes, or searches that cannot be reproduced. Update the data map and search instructions when actual data locations differ from the record.

  • Track the time spent in intake, identity, clarification, search, review, approval, and delivery.
  • Sample completed cases to confirm searches were reasonable and proportionate and redactions were independently checked.
  • Keep current owners and search instructions for archives, messaging, backups, employee systems, and processors.
  • Revise template wording when Article 12A timing or the controller's complaint and remedy information changes.
Sources for this answer
ICO guide to subject access requests
ICO guidance confirms the right of access and the practical response duties that a UK GDPR DSAR workflow must route.
ICO guidance on responding to a right of access request
ICO guidance supports the workflow steps for clarification, refusal handling, explanations, and review evidence.
UK GDPR Article 15 - Right of access by the data subject
Article 15 is the binding UK GDPR source for the access right that the DSAR workflow operationalizes.
Consolidated UK GDPR Articles 12, 12A and 15
Binding current text used to review clocks, pauses, extensions, searches, and response outcomes.
Recommended next step

Assign the UK GDPR DSAR workflow

Assign intake, timing, searches, review, redaction, response, and delivery evidence to named owners.

Assessment workflow
Open Assessment Autopilot for UK GDPR

Create scoped DSAR questions, evidence fields, and review tasks.

Explore next step
Research workflow
Review UK GDPR source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

ICO guide to subject access requests
ico.org.uk
Referenced sections
  • ICO guidance confirms the right of access and the practical response duties that a UK GDPR DSAR workflow must route.
Related guides

Explore more topics

How do you choose a lawful basis under the UK GDPR?
Choose and document the UK GDPR lawful basis that fits each processing purpose, including recognised legitimate interest, in force since 5 February 2026.
UK Children's Code: Scope and 15 Standards
Decide whether an online service is likely to be accessed by UK children and apply the ICO Children's Code standards to product design and personal-data use.
UK GDPR 72-hour Breach Reporting Guide
Decide whether a UK personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report must contain, and when individuals must be told.
UK GDPR 72-Hour Breach Reporting: Decision Guide
Decide whether a personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report needs, and when affected people must be told.
UK GDPR Adequacy Guide
Use UK transfer approval regulations by checking the destination, recipient, data, sector, effective status, scope limits, and review evidence.
UK GDPR Adequacy: When Can You Rely on It?
Check whether current UK adequacy regulations cover a restricted transfer, including partial coverage for Canada, Japan, and the US UK Extension.
UK GDPR AI and Automated Decisions Guide
Current UK GDPR rules for significant solely automated decisions, meaningful human involvement, Article 22B restrictions, and Article 22C safeguards.
UK GDPR AI and Automated Decisions: Articles 22A-22D
Apply the current UK rules for significant solely automated decisions, special-category restrictions, meaningful human involvement, and Article 22C safeguards.
UK GDPR Applicability Test Guide
Apply the UK GDPR material and territorial scope tests to one processing activity, including exclusions, non-UK organisations, roles, and evidence.
UK GDPR Article 30 Records Guide
Build UK GDPR Article 30 records for controller and processor activities, apply the narrow under-250 exception, and keep the records current and available to the ICO.
UK GDPR Article 30 Records: What to Document
See which controllers and processors need records of processing activities, what each record must contain, and how the under-250-employee exemption works.
UK GDPR Breach Notification Guide
Decide whether a personal data breach must be reported to the ICO or communicated to individuals, with deadlines, exceptions, content, and evidence.
UK GDPR Breach Workflow Guide
Run a UK GDPR personal data breach workflow from containment and awareness through risk assessment, ICO reporting, individual notice, and the breach record.
UK GDPR Children and Age Appropriate Design Guide
Apply UK GDPR children's protections and the Age Appropriate Design Code to online services likely to be accessed by children.
UK GDPR Children's Code Guide
A practical guide to Children's Code scope, its 15 standards, age 13 consent, evidence, exceptions, and product implementation.
UK GDPR Compliance Checklist
A verifiable UK GDPR checklist for scope, lawful processing, transparency, rights, governance, security, breaches, DPIAs, children, and transfers.
UK GDPR Compliance FAQ: Duties, Rights, and Decisions
Answer common UK GDPR questions on scope, lawful basis, records, DPIAs, DPOs, rights, breaches, children, automated decisions, and international transfers.
UK GDPR Compliance Guide
Build a UK GDPR compliance programme around processing records, lawful decisions, rights operations, security, incidents, DPIAs, suppliers, and transfers.
UK GDPR Controller and Processor Status Guide
Decide whether each party is a controller, joint controller, or processor under the UK GDPR, then record the role-specific duties, contract terms, and evidence.
UK GDPR Controller or Processor: How to Decide
Decide whether each party is a controller, joint controller, processor, or sub-processor, then record the contracts, responsibilities, and evidence the role requires.
UK GDPR Data Subject Rights Guide
Operate UK GDPR access, rectification, erasure, restriction, portability, objection, and automated-decision rights under the amended Article 12 timing rules.
UK GDPR Deadlines and Compliance Calendar Guide
Track UK GDPR deadlines for rights requests, privacy information, breach notification, DPIAs, and ICO prior consultation, with triggers and exceptions.
UK GDPR DPIA Workflow Guide
Screen UK GDPR processing for likely high risk, complete the required DPIA analysis before processing, reduce risk, and consult the ICO when high residual risk remains.
UK GDPR DPIA: When It Is Required and What to Record
Screen for likely high-risk processing, complete the Article 35 assessment before processing, and consult the ICO if high residual risk remains.
UK GDPR DPIAs and DPOs Guide
Decide when the UK GDPR requires a DPIA or DPO, what each must cover, when to consult the ICO, and what evidence to retain.
UK GDPR DPO: When Appointment Is Mandatory
Apply the three UK GDPR DPO triggers and document expertise, independence, reporting line, resources, tasks, contacts, and conflict controls.
UK GDPR IDTA Addendum and Transfer Risk Assessment Guide
Choose the UK IDTA or Addendum, complete the current Article 46 data protection test, add needed measures, and maintain evidence for restricted transfers.
UK GDPR Lawful Bases Guide
Choose among the six familiar Article 6 bases and the UK's recognised legitimate interests basis, then document any Article 9 or 10 condition.
UK GDPR PECR Cookies Guide
UK GDPR and PECR cookie guidance with practical consent, exemption, evidence, and cited implementation decisions.
UK GDPR Penalties and Fines: Maximums and ICO Factors
Understand the UK GDPR £8.7 million or 2% and £17.5 million or 4% fine ceilings, which infringements fall into each band, and how the ICO sets a fine.
UK GDPR Requirements Guide
Map UK GDPR requirements by processing activity, role, lawful basis, data type, risk, rights, suppliers, automated decisions, and transfers.
UK GDPR Transfer Workflow Guide
Apply the UK GDPR restricted-transfer sequence: map the transfer, check Article 45A approval, choose an Article 46 safeguard and assessment, or justify a specific Article 49 derogation.
UK GDPR Transfers, IDTA, and UK Addendum Guide
Decide whether a UK restricted transfer exists, whether adequacy applies, how to use the IDTA or UK Addendum, and how to document the data protection test.
UK GDPR vs Data Protection Act 2018: How They Work Together
See when to use the UK GDPR, when the Data Protection Act 2018 adds a condition or exemption, and which regime covers law enforcement or intelligence processing.
UK GDPR vs EU GDPR: Scope, Regulators and Transfers
Determine whether UK GDPR, EU GDPR, or both apply, then separate representatives, regulators, transfer routes, national law, and post-Brexit UK amendments.
UK IDTA vs EU SCCs: Which Transfer Contract to Use
Choose between the UK IDTA and EU SCCs with the UK Addendum, complete the right documents, and record the separate UK and EU transfer assessments.
UK IDTA, Addendum, and Transfer Risk Assessment Guide
Decide when to use the UK IDTA or Addendum, complete the Article 46 data protection test, add supplementary measures, and keep the transfer under review.
UK vs EU GDPR Differences After the 2025 UK Reforms
Compare current UK and EU rules for recognised legitimate interests, rights requests, access searches, automated decisions, and international transfers.
UK vs EU GDPR Operations: Regulators, Breaches and Transfers
Configure separate UK and EU privacy operations for representatives, regulator contacts, rights requests, breach reporting, transfer tools, and evidence.
When do PECR cookie rules require consent?
Apply the current UK PECR rules to cookies and similar technologies, including consent, five exceptions, UK GDPR overlap, and evidence.