Someone has asked for their data. What now?
- TimeNot established by the research for writing the procedure. The statutory clock for answering a request is set out on the page.
- CostFree. No fee may generally be charged to the requester either.
- Doing itYou can do this yourself
A request for someone's data is a subject access request under UK GDPR, whatever words they use, and the charity must reply within the deadline. The deadline: One calendar month from receipt, "without undue delay". It runs from when anyone in the charity received it, including a volunteer. Since 5 February 2026 you may pause the clock to ask a reasonable question about a vague request.
Do this first
England and Wales: This page sets out the position in full. Scotland: the same position — data protection is a reserved matter, so UK GDPR, the DPA 2018 and the ICO apply identically. Northern Ireland: the same position, reserved in exactly the same way.
A request can arrive anywhere, in any words
A subject access request is a person’s request, under Article 15 of UK GDPR, for the personal data a charity holds about them. It is valid in any words, by any route, to anyone in the charity. The rule is the same in England and Wales, Scotland and Northern Ireland. It matters to every member of staff, not only the manager who handles requests.
The charity’s policy names who handles requests. If you have not yet written your data protection policy, start there.
Most procedures are written around a form and a named contact. The law is not. The ICO’s guidance says:
“There are no formal requirements for a valid request. A person can make a SAR verbally or in writing, including by social media… The person does not have to include the phrases ‘subject access request’, ‘right of access’ or ‘article 15 of the UK GDPR’ in their request. It just needs to be clear that they are asking for their personal information.”
A request can go to any member of staff, not only a named contact. In a small charity that includes the volunteer on the shop till, whoever answers the phone, and whoever runs your Facebook page. On the ICO’s guidance, you should treat a message like “can I have everything you’ve got on me?” as a valid request, whoever it reaches.
The clock starts when they receive it
The clock runs from the day the request arrives — not from the day it reaches someone who knows what it is.
That is why this is a training problem wearing a policy’s clothes. A perfect written procedure does not help if the request sits in a volunteer’s inbox for weeks. That happens when nobody told them what a request looks like. The deliverable follows from that: everyone briefed, not a form published.
Subject access request deadlines and fees
UK GDPR Article 12(3) has been amended by the Data (Use and Access) Act 2025. It says the controller must act “without undue delay and in any event before the end of the applicable time period (see Article 12A)”. The periods themselves, as the ICO’s guidance states them:
| The rule | |
|---|---|
| Deadline | One calendar month from receipt, "without undue delay" |
| Extension | A further two months (three total) where the request is complex or the person has made multiple simultaneous rights requests — and you must tell them, and why, within the original month |
| Fee | Generally none. A reasonable fee only where the request is manifestly unfounded or excessive, or for further copies of information already supplied |
| Refusal | Wholly or partly, only where manifestly unfounded or excessive — a deliberately high threshold. A request is NOT excessive merely because it covers a large volume |
Two limits in that table are the ones charities trip on.
The extension is narrow. It is available only where the request is complex, or the person has made several requests. You must also tell them, with the reason, inside the original period. A silent extension is a late response.
Large is not excessive. You may refuse only where a request is manifestly unfounded or excessive. That is a deliberately high bar. A request for “everything” is not excessive because it covers a lot. The lawful answer to a big, vague request is the new pause to ask a question, and a reasonable and proportionate search.
New since 5 February 2026: you may pause to ask
The Data (Use and Access) Act 2025 inserted a new Article 12A into UK GDPR, in force since 5 February 2026. It lets you stop the clock while you ask a reasonable question about a vague or high-volume request. The clock starts again the day after you get the answer.
The same Act made “reasonable and proportionate search” a written statutory standard. Before, it came only from case law. You must still search properly. But the standard is now reasonable and proportionate, not exhaustive.
The pause is for a real question, not for delay. “Everything you’ve got on me” from a former volunteer is the right case for it. You can fairly ask whether they mean their volunteer file, emails about them, or both. Asking “please fill in our form first” is not clarification. It does not stop the clock.
Check the receipt date before you choose the rules
The commencement regulations, SI 2026/82 regulation 4, keep the old time limits for any request received before 5 February 2026. The new timing rules apply only to requests received on or after that date.
It sounds like an old problem. It is not, if a request is still open or has come back as a complaint. Rewrite your procedure once, apply it to everything in the queue, and you will get the older requests wrong. Log the receipt date first. Choose the regime second.
Write the day-one action, then brief everyone
The procedure can be short. What matters is the first step. Someone who does not handle requests takes that step:
- Recognise it. Any request for “my information”, in any words, by any route.
- Log the date it arrived, and who received it.
- Pass it on the same day to the named person in your data protection policy.
- Do not ask for a form or a reason. Neither is required.
Then the named person takes over. They:
- check the receipt date and regime
- decide whether a clarifying question is needed
- search
- reply inside the period, or notify an extension, with reasons, inside the original period
The briefing is the other half. Walk every member of staff and every volunteer through what a request can look like. Include the Facebook page and the shop. Record who has been briefed, and when. That record is the kind of evidence the accountability principle asks for, which the trustees weigh when they adopt a data protection policy.
The reply often overlaps with your privacy notice. The ICO lets you point to the notice where it already covers something. The step to write your privacy notice explains the overlap.
Next: We’ve had a breach. Do we have to tell the ICO?
Common mistake: only recognising a request that says “subject access request” and arrives at the office
Procedures get written around a form and a named contact. The ICO is clear about this. A request can be verbal or in writing, including by social media. It needs no particular words, and it can go to any member of staff.
The clock starts when they receive it, not when it reaches someone who knows what it is. This is a training issue, not a policy issue.
Common mistake: refusing or charging because the request is large
A request for “everything” looks unreasonable. But a large volume alone does not make a request excessive. Refusal is possible only where it is manifestly unfounded or excessive, which is a deliberately high threshold.
The lawful response to a vague or high-volume request is the Article 12A pause while you ask for clarification. That comes with a reasonable and proportionate search.
Common mistake: taking the extension without telling the requester inside the original period
The extension is remembered. The condition attached to it is not. It is available only where the request is complex or the person has made several requests. You must also tell them, and why, within the original period. A silent extension is a late response.
Common mistake: applying the new time-limit rules to a request received before they came into force
The procedure is rewritten once and applied to everything in the queue. The commencement instrument keeps the old limits for requests received before 5 February 2026. Check the receipt date before choosing the regime.
Worked example
A former volunteer messages Tollgate Youth CIO’s Facebook page asking for “everything you’ve got on me”.
The volunteer who runs the page has been briefed, so she recognises it. There is no form, no magic phrase and no named recipient. It is a valid request on the day she reads it.
She logs the date and passes it to the charity’s one employee, who is named in the data protection policy. The clock runs from the day the message arrived.
“Everything” could mean a thin volunteer file or several years of group emails. The employee replies asking which the former volunteer wants. That uses the Article 12A pause properly. The clock stops while the question is open. It starts again the day after the answer. No fee is charged. The request is not complex, so no extension is taken.
The outcome is a written procedure that names the day-one action for anyone who receives a request. The log has an entry with the receipt date. Every member of staff and every volunteer has been briefed on what a request can look like.
What you should have at the end
A written SAR procedure, and every member of staff and volunteer briefed on how to recognise one.
The procedure proves you know what to do once a request is recognised. The briefing record proves the more important thing: that a request will be recognised at all. That includes one arriving at the till or on Facebook, on the day it arrives.
Common questions
Generally no. A reasonable fee is allowed only where a request is manifestly unfounded or excessive, or for further copies of information already supplied. A request for everything the charity holds is not excessive because it covers a lot. The lawful answer to a large, vague request is a clarifying question and a proportionate search.
Only in narrow cases, and only if you say so in time: A further two months (three total) where the request is complex or the person has made multiple simultaneous rights requests — and you must tell them, and why, within the original month. An extension you do not notify inside the original period is a late response.