Accountio / Templates / UK GDPR / Subject access request procedure

Subject access request procedure template for accountants

How your firm handles a request from a client, employee or anyone else for a copy of their personal information. This subject access request procedure template sets out seven steps from logging the request to sending the reply, with a response letter that covers what the law says you must tell them.

UK practices
$15
In the pack
UK GDPR pack for practices
Files
10, Word and Excel
Buy the pack · $15
Global library · 101 packs

Get this pack and 100 more for $129

UK GDPR for practices · this packAML complianceCharity accountsEstate administrationMTD for Income TaxP11D and payrollingUK SRS readinessCarbon reduction planCIS+ 92 more
$129$1,42191% off

You save $1,292 on buying them one by one

Buy the global library · $129

What the procedure looks like

Subject access request procedure template
What the procedure coversSection in the procedure
Recognising a request
✓
Opening paragraphNo set words or form, in writing, by email or in person
Passing it on and logging it
✓
Step 1: Pass it on the same dayTo your data protection lead, who records it in the subject access log
Checking who is asking
✓
Step 2: Check identity if neededOnly where there are reasonable doubts, and the time limit starts once you have it
Asking what they want
✓
Step 3: Clarify if neededFor people you hold a lot of information about, with the clock paused until they reply
How far to search
✓
Step 4: SearchA reasonable and proportionate search of systems, email and paper files
Information you hold back
✓
Step 5: Check exemptions before sending anythingOther people's details, and anything that would reveal a suspicion report
The deadline and extensions
✓
Step 6: Respond within one monthUp to two more months for complex or repeated requests, if you tell the person within the first month
Fees and refusals
✓
Step 7: No feeA reasonable fee or a refusal only for manifestly unfounded or excessive requests
What to send with the copy
✓
Response letterPurposes, lawful basis, where the data came from, who receives it, how long you keep it, transfers, withheld information and rights
Where to complain
✓
Response letterYour data protection lead first, then the ICO

When you need it

Any client, former client, employee, job applicant or other person can ask your firm for their information. The deadline runs from the day the request arrives, so staff need to recognise one and pass it on straight away.

  • A client in a fee dispute asks for everything you hold about them
  • A former employee asks for their personnel file and emails that mention them
  • A director of a client company asks what you hold from your AML checks
  • Someone asks on behalf of another person, such as a solicitor for a client
  • A request arrives by email, letter, phone or in conversation at the office

How to use the subject access request procedure template

  1. Fill in your firm's details. Name, data protection lead and their email address.
  2. Brief every member of staff. Anyone can receive a request, so everyone needs to know to pass it on the same day.
  3. Log every request. The subject access sheet in the data protection logs works out the due date, including any pause and extension.
  4. Complete the response letter. Take the purposes, lawful basis, recipients and retention periods from your record of processing.
  5. Record what you withheld and why. Note each exemption in the log, so you can explain it if the person complains.

Questions

What is the time limit for a subject access request?

One month, starting from the latest of the day you receive the request, the day you receive any identity information you asked for, and the day any fee is paid.

Can you stop the clock on a subject access request?

Yes, since 5 February 2026. If you reasonably need more information to find what the person is asking for, for example because you hold a lot about them, you can ask them. The days between your question and their answer don't count towards the deadline.

Can you extend the deadline?

By up to two further months, where that is needed because the requests are complex or because the person has made several. You must tell them before the first month ends and give your reasons.

Do you have to search everything?

No. The Data (Use and Access) Act 2025 confirmed that people are entitled to what you can provide after a reasonable and proportionate search. The rule has effect back to 1 January 2024.

Can you charge for a subject access request?

Usually not. If a request is manifestly unfounded or excessive, for example because it repeats earlier ones, you can charge a reasonable fee based on your costs or refuse it. It is for you to show why.

What must you send with the copy of the data?

Why you use the information, the types of data, who receives it, how long you keep it, the person's rights to correct, delete, restrict or object, where the data came from if not from them, and their right to complain to you and to the ICO.

Also in the UK GDPR pack for practices

Record of processing activitiesData protection policyAppropriate policy documentRetention scheduleData breach procedureData protection logsData protection complaints procedureSoftware and supplier checklistStaff privacy notice

See the whole pack →

Who it's for

Accountancy practices that want every request handled the same way, on time, with the right letter.

Last checked

Checked against the UK GDPR as changed by the Data (Use and Access) Act 2025, on legislation.gov.uk in November 2026.