Subject Access Request Check (UK)

What is this?

A subject access request review usually looks at what data was requested, how the controller verified identity, whether the response was on time, and whether exemptions, redactions, or partial disclosures were applied properly. The central question is whether the controller's response process matches the legal duties imposed by UK data protection law.

Relevant law often includes the UK GDPR, the Data Protection Act 2018, and current ICO guidance on subject access rights.

Key legal requirements

• the request scope, requester identity, and response chronology should be documented clearly
• the controller should be able to show whether any extension, refusal, exemption, or redaction was applied on a proper basis
• the disclosed data and explanatory information should match the records actually held and the request received
• internal notes, search records, and response correspondence should support the position taken if completeness is challenged

Why this matters

SAR disputes often turn on search adequacy, timing, and exemptions, so an incomplete process record can weaken the controller's position quickly.

Next step with VetroCheck

Use the Subject access request agent if you want a structured review of the request, response pack, and disclosure process.

Compliance note

This glossary content is provided for informational and educational purposes only. It does not constitute formal legal advice, does not create a solicitor-client relationship, and should be checked against current legislation, official guidance, and the facts of the specific case.