{"id":176002,"date":"2022-09-21T20:26:50","date_gmt":"2022-09-21T19:26:50","guid":{"rendered":"https:\/\/legalvision.co.uk\/?p=176002"},"modified":"2022-09-27T07:25:01","modified_gmt":"2022-09-27T06:25:01","slug":"sar-request-business","status":"publish","type":"post","link":"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/","title":{"rendered":"How Long Does My Business Have to Respond to a Subject Access Request in England?"},"content":{"rendered":"\n<p><span style=\"font-weight: 400\">Making a <a href=\"https:\/\/ico.org.uk\/your-data-matters\/your-right-to-get-copies-of-your-data\/\">Subject Access Request<\/a> (SAR) to a company is one of the better-known data protection rights. This involves an individual coming to your business and asking for a copy of all personal information.\u00a0These are sometimes called Data Subject Access Requests or DSARs.\u00a0One tricky question is figuring out the time your business has to respond to a SAR.<\/span> <span style=\"font-weight: 400\">This article will explain the timeframe for your organisation to respond to SARs, so your company can safely comply with data protection rules.<\/span><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span style=\"font-weight: 400\">What is a Subject Access Request?<\/span><\/h2>\n\n\n\n<p><span style=\"font-weight: 400\">A SAR is a request from an individual for a copy of their <a href=\"https:\/\/legalvision.co.uk\/data-privacy-it\/customer-data-collection\/\">personal data<\/a>. Your company may receive one from employees, customers and any other party you hold information about.\u00a0<\/span>It is important to understand the time your business has to respond to a SAR.<\/p>\n\n\n\n<p><span style=\"font-weight: 400\">When responding to a SAR, your company should ensure to:&nbsp;<\/span><\/p>\n\n\n\n<ol class=\"wp-block-list\"><li style=\"font-weight: 400\"><span style=\"font-weight: 400\">inform the individual of all specific data held about them;&nbsp;<\/span><\/li><li style=\"font-weight: 400\"><span style=\"font-weight: 400\">provide them with a copy of this information; and&nbsp;<\/span><\/li><li style=\"font-weight: 400\"><span style=\"font-weight: 400\">notify them who else has received that information.&nbsp;<\/span><\/li><\/ol>\n\n\n\n<p><span style=\"font-weight: 400\">Previously, organisations could charge a small fee for searching for materials, but this is no longer the case. An exception is if the SAR is \u2018excessive\u2019 or where the individual requests multiple copies.<\/span><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span style=\"font-weight: 400\">One Month Rule<\/span><\/h2>\n\n\n\n<p><span style=\"font-weight: 400\">The starting principle is that your business should respond to a SAR without delay and provide the requested information no later than one month after receipt.<\/span><\/p>\n\n\n\n<div  class=\"box box--icon box--info\">\n    <p>For example, if you receive a SAR from an individual on 6th July, your initial time limit for the provision of the relevant materials would be 6th August.<\/p>\n<\/div>\n\n\n\n\n<a href=\"#content-next\"\n   class=\"block p-4 mt-10 text-xl font-bold text-center text-white no-underline bg-gray-800 rounded-t-xl\">\n    Continue reading this article below the form\n    <i class=\"text-xl fa-regular fa-arrow-down\"><\/i>\n<\/a>\n<div class=\"px-6 pt-10 pb-12 mb-10 text-center bg-gray-100 rounded-b-xl sm:px-12 test\">\n    <div class=\"mb-8 text-2xl font-bold text-orange\">\n        Need legal advice?\n        <br>\n        <span class=\"text-lg not-prose\">\n                            Call <a href=\"tel:+448081968584\" class=\"not-prose\">0808 196 8584<\/a> for urgent assistance.\n                <br>\n                Otherwise, complete this form, and we will contact you within one business day.\n                    <\/span>\n    <\/div>\n\n    \n\n<div class=\"not-prose flex justify-center text-left gform_input_bg_white    \">\n    <script>\nvar gform;gform||(document.addEventListener(\"gform_main_scripts_loaded\",function(){gform.scriptsLoaded=!0}),document.addEventListener(\"gform\/theme\/scripts_loaded\",function(){gform.themeScriptsLoaded=!0}),window.addEventListener(\"DOMContentLoaded\",function(){gform.domLoaded=!0}),gform={domLoaded:!1,scriptsLoaded:!1,themeScriptsLoaded:!1,isFormEditor:()=>\"function\"==typeof InitializeEditor,callIfLoaded:function(o){return!(!gform.domLoaded||!gform.scriptsLoaded||!gform.themeScriptsLoaded&&!gform.isFormEditor()||(gform.isFormEditor()&&console.warn(\"The use of gform.initializeOnLoaded() is deprecated in the form editor context and will be removed in Gravity Forms 3.1.\"),o(),0))},initializeOnLoaded:function(o){gform.callIfLoaded(o)||(document.addEventListener(\"gform_main_scripts_loaded\",()=>{gform.scriptsLoaded=!0,gform.callIfLoaded(o)}),document.addEventListener(\"gform\/theme\/scripts_loaded\",()=>{gform.themeScriptsLoaded=!0,gform.callIfLoaded(o)}),window.addEventListener(\"DOMContentLoaded\",()=>{gform.domLoaded=!0,gform.callIfLoaded(o)}))},hooks:{action:{},filter:{}},addAction:function(o,r,e,t){gform.addHook(\"action\",o,r,e,t)},addFilter:function(o,r,e,t){gform.addHook(\"filter\",o,r,e,t)},doAction:function(o){gform.doHook(\"action\",o,arguments)},applyFilters:function(o){return gform.doHook(\"filter\",o,arguments)},removeAction:function(o,r){gform.removeHook(\"action\",o,r)},removeFilter:function(o,r,e){gform.removeHook(\"filter\",o,r,e)},addHook:function(o,r,e,t,n){null==gform.hooks[o][r]&&(gform.hooks[o][r]=[]);var d=gform.hooks[o][r];null==n&&(n=r+\"_\"+d.length),gform.hooks[o][r].push({tag:n,callable:e,priority:t=null==t?10:t})},doHook:function(r,o,e){var t;if(e=Array.prototype.slice.call(e,1),null!=gform.hooks[r][o]&&((o=gform.hooks[r][o]).sort(function(o,r){return o.priority-r.priority}),o.forEach(function(o){\"function\"!=typeof(t=o.callable)&&(t=window[t]),\"action\"==r?t.apply(null,e):e[0]=t.apply(null,e)})),\"filter\"==r)return e[0]},removeHook:function(o,r,t,n){var e;null!=gform.hooks[o][r]&&(e=(e=gform.hooks[o][r]).filter(function(o,r,e){return!!(null!=n&&n!=o.tag||null!=t&&t!=o.priority)}),gform.hooks[o][r]=e)}});\n<\/script>\n\n                <div class='gf_browser_gecko gform_wrapper gravity-theme gform-theme--no-framework lawyer-form_wrapper gplaceholder_wrapper form-with-labels-no-asterisks_wrapper has-new-validation-error-styling_wrapper' data-form-theme='gravity-theme' data-form-index='0' id='gform_wrapper_2453' style='display:none'><div id='gf_2453' class='gform_anchor' tabindex='-1'><\/div><form method='post' enctype='multipart\/form-data' target='gform_ajax_frame_2453' id='gform_2453' class='lawyer-form gplaceholder form-with-labels-no-asterisks has-new-validation-error-styling' action='\/api\/wp\/v2\/posts\/176002#gf_2453' data-formid='2453' novalidate>\n                        <div class='gform-body gform_body'><div id='gform_fields_2453' class='gform_fields top_label form_sublabel_below description_below validation_below'><div id=\"field_2453_1000\" class=\"gfield gfield--type-honeypot gform_validation_container field_sublabel_below gfield--has-description field_description_below field_validation_below gfield_visibility_visible\"  ><label class='gfield_label gform-field-label' for='input_2453_1000'>Company<\/label><div class='ginput_container'><input name='input_1000' id='input_2453_1000' type='text' value='' autocomplete='new-password'\/><\/div><div class='gfield_description' id='gfield_description_2453_1000'>This field is for validation purposes and should be left unchanged.<\/div><\/div><div id=\"field_2453_1\" class=\"gfield gfield--type-text gfield--input-type-text gf_left_half gfield--width-half gfield_contains_required field_sublabel_below gfield--no-description field_description_below field_validation_below gfield_visibility_visible\"  ><label class='gfield_label gform-field-label' for='input_2453_1'>First Name<span class=\"gfield_required\"><span class=\"gfield_required gfield_required_text\">(Required)<\/span><\/span><\/label><div class='ginput_container ginput_container_text'><input name='input_1' id='input_2453_1' type='text' value='' class='medium'     aria-required=\"true\" aria-invalid=\"false\"   \/><\/div><\/div><div id=\"field_2453_12\" class=\"gfield gfield--type-text gfield--input-type-text gf_right_half gfield--width-half gfield_contains_required field_sublabel_below gfield--no-description field_description_below field_validation_below gfield_visibility_visible\"  ><label class='gfield_label gform-field-label' for='input_2453_12'>Last Name<span class=\"gfield_required\"><span class=\"gfield_required gfield_required_text\">(Required)<\/span><\/span><\/label><div class='ginput_container ginput_container_text'><input name='input_12' id='input_2453_12' type='text' value='' class='medium'     aria-required=\"true\" aria-invalid=\"false\"   \/><\/div><\/div><div id=\"field_2453_2\" class=\"gfield gfield--type-email gfield--input-type-email gf_left_half gfield--width-half gfield_contains_required field_sublabel_below gfield--no-description field_description_below field_validation_below gfield_visibility_visible\"  ><label class='gfield_label gform-field-label' for='input_2453_2'>Email Address<span class=\"gfield_required\"><span class=\"gfield_required gfield_required_text\">(Required)<\/span><\/span><\/label><div class='ginput_container ginput_container_email'>\n                            <input name='input_2' id='input_2453_2' type='email' value='' class='medium'    aria-required=\"true\" aria-invalid=\"false\"  \/>\n                        <\/div><\/div><div id=\"field_2453_3\" class=\"gfield gfield--type-phone gfield--input-type-phone gf_right_half gfield--width-half gfield_contains_required field_sublabel_below gfield--no-description field_description_below field_validation_below gfield_visibility_visible\"  ><label class='gfield_label gform-field-label' for='input_2453_3'>Phone<span class=\"gfield_required\"><span class=\"gfield_required gfield_required_text\">(Required)<\/span><\/span><\/label><div class='ginput_container ginput_container_phone'><input name='input_3' id='input_2453_3' type='tel' value='' class='medium'   aria-required=\"true\" aria-invalid=\"false\"   \/><\/div><\/div><div id=\"field_2453_14\" class=\"gfield gfield--type-select gfield--input-type-select gfield--width-full custom-select gfield_contains_required field_sublabel_below gfield--no-description field_description_below field_validation_below gfield_visibility_visible\"  ><label class='gfield_label gform-field-label' for='input_2453_14'>Number of Employees in Your Business<span class=\"gfield_required\"><span class=\"gfield_required gfield_required_text\">(Required)<\/span><\/span><\/label><div class='ginput_container ginput_container_select'><select name='input_14' id='input_2453_14' class='large gfield_select'    aria-required=\"true\" aria-invalid=\"false\" ><option value='' selected='selected'>Select ...<\/option><option value='0' >0<\/option><option value='1' >1-5<\/option><option value='6' >6-20<\/option><option value='21' >21-50<\/option><option value='51' >51-250<\/option><option value='250' >250+<\/option><\/select><\/div><\/div><div id=\"field_2453_4\" class=\"gfield gfield--type-textarea gfield--input-type-textarea gfield_contains_required field_sublabel_below gfield--no-description field_description_below field_validation_below gfield_visibility_visible\"  ><label class='gfield_label gform-field-label' for='input_2453_4'>Tell us about your enquiry<span class=\"gfield_required\"><span class=\"gfield_required gfield_required_text\">(Required)<\/span><\/span><\/label><div class='ginput_container ginput_container_textarea'><textarea name='input_4' id='input_2453_4' class='textarea medium'     aria-required=\"true\" aria-invalid=\"false\"   rows='10' cols='50'><\/textarea><\/div><\/div><div id=\"field_2453_5\" class=\"gfield gfield--type-html gfield--input-type-html gfield_html gfield_html_formatted gfield_no_follows_desc field_sublabel_below gfield--no-description field_description_below field_validation_below gfield_visibility_visible\"  >By submitting this form, you agree to receive emails from LegalVision and can unsubscribe at any time. View our <a href=\"https:\/\/legalvision.co.uk\/privacy-notice\/\" target=\"_blank\">Privacy Policy<\/a>. <\/div><div id=\"field_2453_8\" class=\"gfield gfield--type-hidden gfield--input-type-hidden gform_hidden field_sublabel_below gfield--no-description field_description_below field_validation_below gfield_visibility_visible\"  ><div class='ginput_container ginput_container_text'><input name='input_8' id='input_2453_8' type='hidden' class='gform_hidden'  aria-invalid=\"false\" value='http:\/\/legalvision.co.uk\/api\/wp\/v2\/posts\/176002' \/><\/div><\/div><div id=\"field_2453_13\" class=\"gfield gfield--type-hidden gfield--input-type-hidden gform_hidden field_sublabel_below gfield--no-description field_description_below field_validation_below gfield_visibility_visible\"  ><div class='ginput_container ginput_container_text'><input name='input_13' id='input_2453_13' type='hidden' class='gform_hidden'  aria-invalid=\"false\" value='generic_form' \/><\/div><\/div><fieldset id=\"field_2453_999\" class=\"gfield gfield--type-checkbox gfield--type-choice gfield__uk-marketo-opt-in field_sublabel_below gfield--no-description field_description_below field_validation_below gfield_visibility_visible\"  ><legend class='gfield_label gform-field-label screen-reader-text' ><\/legend><div class='ginput_container ginput_container_checkbox'><div class='gfield_checkbox ' id='input_2453_999'><div class='gchoice gchoice_2453_999_1'>\n\t\t\t\t\t\t\t\t<input class='gfield-choice-input' name='input_999.1' type='checkbox'  value='1'  id='choice_2453_999_1'   \/>\n\t\t\t\t\t\t\t\t<label for='choice_2453_999_1' id='label_2453_999_1' class='gform-field-label gform-field-label--type-inline'>By submitting this form, you agree to receive content and event invitations from us to help you grow your business. If you do not want to receive such messages, tick here.<\/label>\n\t\t\t\t\t\t\t<\/div><\/div><\/div><\/fieldset><\/div><\/div>\n        <div class='gform-footer gform_footer top_label'> <button type=\"submit\" id=\"gform_submit_button_2453\" class=\"gform_button button\" onclick=\"gform.submission.handleButtonClick(this);\" data-submission-type=\"submit\"><span class=\"gform_submit_button__text\">Submit Now<\/span><\/button> <input type='hidden' name='gform_ajax' value='form_id=2453&amp;title=&amp;description=&amp;tabindex=0&amp;theme=gravity-theme&amp;hash=ec2463697d0d9cef7b71236ae60964c7' \/>\n            <input type='hidden' class='gform_hidden' name='gform_submission_method' data-js='gform_submission_method_2453' value='iframe' \/>\n            <input type='hidden' class='gform_hidden' name='gform_theme' data-js='gform_theme_2453' id='gform_theme_2453' value='gravity-theme' \/>\n            <input type='hidden' class='gform_hidden' name='gform_style_settings' data-js='gform_style_settings_2453' id='gform_style_settings_2453' value='' \/>\n            <input type='hidden' class='gform_hidden' name='is_submit_2453' value='1' \/>\n            <input type='hidden' class='gform_hidden' name='gform_submit' value='2453' \/>\n            \n            <input type='hidden' class='gform_hidden' name='gform_currency' data-currency='GBP' value='CSudkenc7iXFxf\/LlCXayJVeoGb2UULLxYuRQ+55RX1JlIIuawOWQwz3E566hrQIs1lBt9eKvk0Y+pgTyo8TAnu5yAYFkjsi0nj3Wzz17q60FUM=' \/>\n            <input type='hidden' class='gform_hidden' name='gform_unique_id' value='' \/>\n            <input type='hidden' class='gform_hidden' name='state_2453' value='WyJ7XCIxNFwiOltcIjIyODY0N2ViMWU3NTcxZjA4YTY4NGJmMDcwMTk3Y2I0XCIsXCJiMzk3YmQ1MDBmMmFjNjk1ODE4MzdmNTBhYTA2MzQ0OFwiLFwiNGYyNGZkZGEwMzlkNDUxMWFhZGE1NGYwZmQwZmNiZTdcIixcIjUyMmJkMDE2M2I2ZmEwOTI3NDZhZjU5YTg0ZmM1NDk5XCIsXCIzODRlNjk1YjQxMTAzMWFiYmQ2ODEyMGYyZWFhMDYyNlwiLFwiYjkzNDcwNTE2MjkxOGRjZWViMjQzNzRjNmE0NGVmNTlcIixcIjQxMTliODZhMzVjYzJiMWViNDZiMmQ4NjRlNGUzZmNjXCJdfSIsIjQ3MjNiMzA2ZDIyZGVkODA2N2YyMjYyOThkYzI1ODVmIl0=' \/>\n            <input type='hidden' autocomplete='off' class='gform_hidden' name='gform_target_page_number_2453' id='gform_target_page_number_2453' value='0' \/>\n            <input type='hidden' autocomplete='off' class='gform_hidden' name='gform_source_page_number_2453' id='gform_source_page_number_2453' value='1' \/>\n            <input type='hidden' name='gform_field_values' value='' \/>\n            \n        <\/div>\n                        <\/form>\n                        <\/div>\n\t\t                <iframe style='display:none;width:0px;height:0px;' src='about:blank' name='gform_ajax_frame_2453' id='gform_ajax_frame_2453' title='This iframe contains the logic required to handle Ajax powered Gravity Forms.'><\/iframe>\n\t\t                <script>\ngform.initializeOnLoaded( function() {gformInitSpinner( 2453, 'https:\/\/legalvision.co.uk\/wp-content\/themes\/legalv-v6\/img\/spinner.svg', true );jQuery('#gform_ajax_frame_2453').on('load',function(){var contents = jQuery(this).contents().find('*').html();var is_postback = contents.indexOf('GF_AJAX_POSTBACK') >= 0;if(!is_postback){return;}var form_content = jQuery(this).contents().find('#gform_wrapper_2453');var is_confirmation = jQuery(this).contents().find('#gform_confirmation_wrapper_2453').length > 0;var is_redirect = contents.indexOf('gformRedirect(){') >= 0;var is_form = form_content.length > 0 && ! is_redirect && ! is_confirmation;var mt = parseInt(jQuery('html').css('margin-top'), 10) + parseInt(jQuery('body').css('margin-top'), 10) + 100;if(is_form){form_content.find('form').css('opacity', 0);jQuery('#gform_wrapper_2453').html(form_content.html());if(form_content.hasClass('gform_validation_error')){jQuery('#gform_wrapper_2453').addClass('gform_validation_error');} else {jQuery('#gform_wrapper_2453').removeClass('gform_validation_error');}setTimeout( function() { \/* delay the scroll by 50 milliseconds to fix a bug in chrome *\/ jQuery(document).scrollTop(jQuery('#gform_wrapper_2453').offset().top - mt); }, 50 );if(window['gformInitDatepicker']) {gformInitDatepicker();}if(window['gformInitPriceFields']) {gformInitPriceFields();}var current_page = jQuery('#gform_source_page_number_2453').val();gformInitSpinner( 2453, 'https:\/\/legalvision.co.uk\/wp-content\/themes\/legalv-v6\/img\/spinner.svg', true );jQuery(document).trigger('gform_page_loaded', [2453, current_page]);window['gf_submitting_2453'] = false;}else if(!is_redirect){var confirmation_content = jQuery(this).contents().find('.GF_AJAX_POSTBACK').html();if(!confirmation_content){confirmation_content = contents;}jQuery('#gform_wrapper_2453').replaceWith(confirmation_content);jQuery(document).scrollTop(jQuery('#gf_2453').offset().top - mt);jQuery(document).trigger('gform_confirmation_loaded', [2453]);window['gf_submitting_2453'] = false;wp.a11y.speak(jQuery('#gform_confirmation_message_2453').text());}else{jQuery('#gform_2453').append(contents);if(window['gformRedirect']) {gformRedirect();}}jQuery(document).trigger(\"gform_pre_post_render\", [{ formId: \"2453\", currentPage: \"current_page\", abort: function() { this.preventDefault(); } }]);        if (event && event.defaultPrevented) {                return;        }        const gformWrapperDiv = document.getElementById( \"gform_wrapper_2453\" );        if ( gformWrapperDiv ) {            const visibilitySpan = document.createElement( \"span\" );            visibilitySpan.id = \"gform_visibility_test_2453\";            gformWrapperDiv.insertAdjacentElement( \"afterend\", visibilitySpan );        }        const visibilityTestDiv = document.getElementById( \"gform_visibility_test_2453\" );        let postRenderFired = false;        function triggerPostRender() {            if ( postRenderFired ) {                return;            }            postRenderFired = true;            gform.core.triggerPostRenderEvents( 2453, current_page );            if ( visibilityTestDiv ) {                visibilityTestDiv.parentNode.removeChild( visibilityTestDiv );            }        }        function debounce( func, wait, immediate ) {            var timeout;            return function() {                var context = this, args = arguments;                var later = function() {                    timeout = null;                    if ( !immediate ) func.apply( context, args );                };                var callNow = immediate && !timeout;                clearTimeout( timeout );                timeout = setTimeout( later, wait );                if ( callNow ) func.apply( context, args );            };        }        const debouncedTriggerPostRender = debounce( function() {            triggerPostRender();        }, 200 );        if ( visibilityTestDiv && visibilityTestDiv.offsetParent === null ) {            const observer = new MutationObserver( ( mutations ) => {                mutations.forEach( ( mutation ) => {                    if ( mutation.type === 'attributes' && visibilityTestDiv.offsetParent !== null ) {                        debouncedTriggerPostRender();                        observer.disconnect();                    }                });            });            observer.observe( document.body, {                attributes: true,                childList: false,                subtree: true,                attributeFilter: [ 'style', 'class' ],            });        } else {            triggerPostRender();        }    } );} );\n<\/script>\n<\/div>\n<\/div>\n<div id=\"content-next\"><!-- scroll anchor --><\/div>\n<h2 class=\"wp-block-heading\"><span style=\"font-weight: 400\">Events That \u2018Pause\u2019 the One-Month Timeframe<\/span><\/h2>\n\n\n\n<p><span style=\"font-weight: 400\">There are three main circumstances in which your company can safely \u2018pause\u2019 the one-month deadline for businesses to respond to a SAR, which includes times when your business is awaiting:<\/span><\/p>\n\n\n\n<ol class=\"wp-block-list\"><li style=\"font-weight: 400\"><span style=\"font-weight: 400\">confirmation of the individual\u2019s identity;<\/span><\/li><li style=\"font-weight: 400\"><span style=\"font-weight: 400\">additional information to enable your business to carry out the SAR; or<\/span><\/li><li style=\"font-weight: 400\"><span style=\"font-weight: 400\">receipt of a relevant fee to carry out the search.<\/span><\/li><\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><span style=\"font-weight: 400\">Confirmation of Identity<\/span><\/h3>\n\n\n\n<p><span style=\"font-weight: 400\">Let us say that you receive a SAR from an email address with an individual&#8217;s name as the signature, and you do not recognise the email address and have not received an email from that address before.<\/span><\/p>\n\n\n\n<p><span style=\"font-weight: 400\">In this case, you may request a copy of personal ID from the requester to confirm their identity to avoid unwittingly providing the personal information to someone else.<\/span><\/p>\n\n\n\n<p><span style=\"font-weight: 400\">If you request a copy of personal ID from the requester on 10th July and they provide it to you on 17th July, you can add one week to the timeframe to respond. This would make your timeframe one month and one week from receipt of the SAR.<\/span><\/p>\n\n\n\n    <div class=\"my-7 lg:my-10 border-y-2 border-gray-100 py-7 lg:py-10 flex flex-col sm:flex-row items-start gap-10\">\n                    <img decoding=\"async\" class=\"w-52 mx-auto my-0! rounded\" src=\"https:\/\/img.legalvision.com.au\/wp-content\/uploads\/sites\/4\/2022\/09\/16051654\/UK-Trade-Mark-Essentials-Screenshot-290x410-1.jpg\" alt=\"Front page of publication\"\n                 loading=\"lazy\" width=\"208\" height=\"298\">\n                <section>\n            <div class=\"text-2xl font-bold\">Trade Mark Essentials<\/div>\n            <div class=\"body-text\">\n                <p>LegalVision&#8217;s Trade Mark Essentials Guide provides valuable information for any business looking to register or enforce a trade mark. <\/p>\n            <\/div>\n            \n\n<a href=\"https:\/\/go.legalvision.co.uk\/uk-trade-mark-essentials-guide.html\" class=\" block px-5 py-3.5 max-w-fit bg-orange button__hover transition rounded text-white font-bold text-lg no-underline uppercase leading-tight text-center\" target=\"\" rel=\"\">Download Now<\/a>        <\/section>\n    <\/div>\n\n\n\n\n<h3 class=\"wp-block-heading\"><span style=\"font-weight: 400\">Request for Additional Information<\/span><\/h3>\n\n\n\n<p><span style=\"font-weight: 400\">It is often helpful to ensure you understand the information the individual seeks. In this way, your company can go back to them and <a href=\"https:\/\/legalvision.co.uk\/data-privacy-it\/benefits-data-protection-officer\/\">ask for further details<\/a> on the materials sought and the purpose of their request.<\/span><\/p>\n\n\n\n<p><span style=\"font-weight: 400\">Suppose you return to the requester (otherwise known as a \u2018data subject\u2019) and ask for additional information. Four days later, they return and state that they are looking for payslips because of needing to argue a personal tax issue with HMRC.&nbsp;&nbsp;<\/span><\/p>\n\n\n\n<p><span style=\"font-weight: 400\">If they are happy, your company can limit its disclosure to the documentation linked to pay and tax rather than all personal data. Likewise, since it took the requester four days to return to your query, the clock for a response was \u2018paused\u2019 for four days, making the deadline for a response one month and four days from the corresponding date of the SAR.<\/span><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span style=\"font-weight: 400\">Awaiting Payment of a Fee<\/span><\/h3>\n\n\n\n<p><span style=\"font-weight: 400\">UK data protection rules follow the principle that you should not <a href=\"https:\/\/legalvision.co.uk\/data-privacy-it\/refuse-sar\/\">charge a fee<\/a> for SARs.\u00a0 However, your company may be able to charge a fee for a SAR in the following circumstances:<\/span><\/p>\n\n\n\n<ol class=\"wp-block-list\"><li style=\"font-weight: 400\"><span style=\"font-weight: 400\">where the request is \u2018manifestly unfounded or excessive\u2019 (for example, being used to harass your company, bully a particular employee or with malicious intentions); or<\/span><\/li><li style=\"font-weight: 400\"><span style=\"font-weight: 400\">where an individual asks for further copies of a SAR (an organisation only has to provide one copy absent a charge).<\/span><\/li><\/ol>\n\n\n\n<p><span style=\"font-weight: 400\">While tempting, labelling a request as \u2018manifestly unfounded or excessive\u2019 can be complex and legal advice is usually recommended. In such circumstances, your business can only charge a \u2018reasonable fee\u2019 to cover reasonable time and financial costs.<\/span><\/p>\n\n\n\n<p><span style=\"font-weight: 400\">In any event, if a fee is formally requested, the clock is \u2018paused\u2019 whilst awaiting payment of the reasonable fee. If it takes the individual two weeks to pay, there will be an extension of your initial deadline for response by those two weeks. Ultimately, your organisation does not have to start searching for materials until receipt of payment.<\/span><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span style=\"font-weight: 400\">Exemptions Allowing More Than One Month to Respond<\/span><\/h2>\n\n\n\n<p><span style=\"font-weight: 400\">There are specific scenarios in which a longer initial deadline of three months can apply.<\/span><\/p>\n\n\n\n<div  class=\"box box--icon box--info\">\n    <p>A three-month deadline for your business to respond to a SAR is possible where the SAR is particularly \u2018complex\u2019 in nature, or the individual makes multiple SARs over a short period.<\/p>\n<\/div>\n\n\n\n<p><span style=\"font-weight: 400\">The <a href=\"https:\/\/ico.org.uk\/\">Information Commissioner\u2019s Office<\/a> (ICO) is responsible for enforcing data protection law and ensuring SAR good practice. It is important to note that the ICO will likely require strong reasoning to justify a three-month deadline. Without such reasoning, the ICO may label it a breach of the one-month requirement. Adequate\u00a0reasons could include:<\/span><\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><span style=\"font-weight: 400\">difficulty accessing some of the information (for example, because you store it at another location);<\/span><\/li><li><span style=\"font-weight: 400\">the SAR requires an extensive search of thousands of documents;<\/span><\/li><li><span style=\"font-weight: 400\">the materials involve excessive mention of other individuals and need large-scale redaction (blanking out the names of others to protect their confidentiality); or<\/span><\/li><li><span style=\"font-weight: 400\">the need to obtain specialist legal advice and assistance due to the nature of some of the documents requested.<\/span><\/li><\/ol>\n\n\n\n<p><span style=\"font-weight: 400\">The vast majority of SARs have a one-month time limit, so it is worth obtaining legal advice should your organisation wish to treat the deadline as three calendar months. If your company wishes to take up to three months, it should notify the author of the SAR in writing.&nbsp;<\/span><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span style=\"font-weight: 400\">Key Takeaways<\/span><\/h2>\n\n\n\n<p><span style=\"font-weight: 400\">Safe handling of SARs is crucial as your business will breach data protection law. If you do not handle SARs correctly, your business is at risk of a fine by the Information Commissioner&#8217;s Office (ICO). Notably, you have one calendar month to respond to SARs, though there are limited exceptions. It is advisable to engage a lawyer as the exemption is not straightforward and may require legal expertise.<\/span><\/p>\n\n\n\n<p><span style=\"font-weight: 400\">If you need help handling Subject Access Requests, <\/span><a href=\"https:\/\/legalvision.co.uk\/it-lawyers-lp\/\"><span style=\"font-weight: 400\">LegalVision&#8217;s data, privacy and IT lawyers<\/span><\/a><span style=\"font-weight: 400\"> can assist as part of our LegalVision membership.&nbsp; For a low monthly fee, you will have unlimited access to lawyers to answer your questions and draft and review your documents.&nbsp; Call us today on <a href=\"tel:+448081968584\" class=\"AVANSERnumber dynamic-number\">0808 196 8584<\/a> or visit our <\/span><a href=\"https:\/\/legalvision.co.uk\/membership\"><span style=\"font-weight: 400\">membership<\/span><\/a><span style=\"font-weight: 400\"> page.<\/span><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span style=\"font-weight: 400\">Frequently Asked Questions<\/span><\/h2>\n\n\n\n<div class=\"schema-faq wp-block-yoast-faq-block\"><div class=\"schema-faq-section\" id=\"faq-question-1663785721433\"><strong class=\"schema-faq-question\"><b>What information can my business refuse to provide when it faces a SAR?<\/b><\/strong> <p class=\"schema-faq-answer\"><span style=\"font-weight: 400;\">When responding to a SAR, your business can refuse to provide information related to individuals other than the author and documents that record protected legal advice (known as the \u2018legal professional privilege\u2019 exception).<\/span><\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1663785780289\"><strong class=\"schema-faq-question\"><b>Can my business refuse to carry out a SAR?<\/b><\/strong> <p class=\"schema-faq-answer\"><span style=\"font-weight: 400;\">Only very occasionally can your business refuse to provide a SAR, and it can be risky to do so. The primary example would be when an individual makes two SAR requests and asks for the same information in both. Your company could state they will concentrate on the first request but ignore the second SAR because it is an unnecessary repetition of the first.<\/span><\/p> <\/div> <\/div>\n<div class=\"not-prose m-feedback-prompt\">\n    <!-- Thumbs up\/down bar -->\n    <div class=\"m-feedback-prompt__main\">\n        <div class=\"m-feedback-prompt__title\">Was this article helpful?<\/div>\n        <div>\n            <!--span class=\"m-feedback-prompt__button--text\">Thanks!<\/span-->\n            <button type=\"button\" class=\"m-feedback-prompt__button m-feedback-prompt__button--yes\"\n                    data-analytics-link=\"feedback-prompt:yes\" aria-label=\"Agree\">\n                <i class=\"fa-regular fa-thumbs-up fa-3x\"><\/i>\n            <\/button>\n            <button type=\"button\" class=\"m-feedback-prompt__button m-feedback-prompt__button--no\"\n                    data-analytics-link=\"feedback-prompt:no\" aria-label=\"Disagree\">\n                <i class=\"fa-regular fa-thumbs-down fa-3x\"><\/i>\n            <\/button>\n        <\/div>\n    <\/div>\n\n    <!-- Feedback form -->\n    <div class=\"m-feedback-prompt__form\">\n        <div class=\"m-feedback-prompt__form--thanks \">\n            <div>Thanks!<\/div>\n            <p>\n                We appreciate your feedback \u2013 your submission has been successfully received.            <\/p>\n        <\/div>\n        <form id=\"contact-form\" class=\"m-feedback-prompt__form--form\" action=\"\" method=\"post\">\n            <input type=\"hidden\" id=\"authenticity_token\" name=\"authenticity_token\" value=\"9eb4f72322\" \/><input type=\"hidden\" name=\"_wp_http_referer\" value=\"\/api\/wp\/v2\/posts\/176002\" \/>            <input value=\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/\" type=\"hidden\" name=\"currenturl\"\n                   id=\"currenturl\">\n            <input value=\"How Long Does My Business Have to Respond to a Subject Access Request in England?\" type=\"hidden\" name=\"currenttitle\"\n                   id=\"currenttitle\">\n            <label>\n                <!-- display on thumbs-up -->\n                <span class=\"m-feedback-prompt__feedback m-feedback-prompt__feedback--yes\">\n                    Can you tell us <span class=\"font-semibold\">why<\/span> you found it helpful?\n                <\/span>\n\n                <!-- display on thumbs-down -->\n                <span class=\"m-feedback-prompt__feedback m-feedback-prompt__feedback--no text-lg\">\n                    How can we better improve this article?\n                <\/span>\n                <textarea name=\"feedbackmessage\" id=\"feedbackmessage\" required><\/textarea>\n            <\/label>\n\n            <div class=\"m-feedback-prompt__form--error\" id=\"form-submit-error\"><\/div>\n            <button id=\"submit-contact-form-button\" type=\"submit\" name=\"commit\" class=\"m-feedback-prompt__form--submit\"\n                    data-analytics-link=\"feedback-prompt:submit\">\n                Submit            <\/button>\n        <\/form>\n    <\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Making a Subject Access Request (SAR) to a company is one of the better-known data protection rights. This involves an individual coming to your business and asking for a copy of all personal information.\u00a0These are sometimes called Data Subject Access Requests or DSARs.\u00a0One tricky question is figuring out the time your business has to respond<a href=\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/\">Continue reading <span class=\"sr-only\">&#8220;How Long Does My Business Have to Respond to a Subject Access Request in England?&#8221;<\/span><\/a><\/p>\n","protected":false},"author":13349,"featured_media":3104,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"175173,3634,174892,2218,4295,1264","_relevanssi_noindex_reason":"","editor_notices":[],"footnotes":""},"categories":[27],"tags":[20,365,746,798,1022],"class_list":["post-176002","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-privacy-it","tag-small-business","tag-gdpr","tag-ico","tag-data-protection-rules","tag-sar"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.1.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How Should My Business Respond to a SAR? | LegalVision UK<\/title>\n<meta name=\"description\" content=\"Your business must respond to a Subject Action Request in a timely manner. We explain how long your business has to respond to a SAR.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How Should My Business Respond to a SAR? | LegalVision UK\" \/>\n<meta property=\"og:description\" content=\"Your business must respond to a Subject Action Request in a timely manner. We explain how long your business has to respond to a SAR.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/\" \/>\n<meta property=\"og:site_name\" content=\"LegalVision UK\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/LegalVision\" \/>\n<meta property=\"article:published_time\" content=\"2022-09-21T19:26:50+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-09-27T06:25:01+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/img.legalvision.com.au\/wp-content\/uploads\/sites\/4\/2022\/05\/24121449\/business-image-052244.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"775\" \/>\n\t<meta property=\"og:image:height\" content=\"517\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Thomas Sutherland\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@LegalVision_law\" \/>\n<meta name=\"twitter:site\" content=\"@LegalVision_law\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Thomas Sutherland\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/\"},\"author\":{\"name\":\"Thomas Sutherland\",\"@id\":\"https:\/\/legalvision.co.uk\/#\/schema\/person\/46d22f7d1b4ba321fe5b1cdc648cc5d2\"},\"headline\":\"How Long Does My Business Have to Respond to a Subject Access Request in England?\",\"datePublished\":\"2022-09-21T19:26:50+00:00\",\"dateModified\":\"2022-09-27T06:25:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/\"},\"wordCount\":1210,\"image\":{\"@id\":\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/img.legalvision.com.au\/wp-content\/uploads\/sites\/4\/2022\/05\/24121449\/business-image-052244.jpg\",\"keywords\":[\"small business\",\"gdpr\",\"ICO\",\"data protection rules\",\"SAR\"],\"articleSection\":[\"Data, Privacy and IT Articles\"],\"inLanguage\":\"en-GB\"},{\"@type\":[\"WebPage\",\"FAQPage\"],\"@id\":\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/\",\"url\":\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/\",\"name\":\"How Should My Business Respond to a SAR? | LegalVision UK\",\"isPartOf\":{\"@id\":\"https:\/\/legalvision.co.uk\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/img.legalvision.com.au\/wp-content\/uploads\/sites\/4\/2022\/05\/24121449\/business-image-052244.jpg\",\"datePublished\":\"2022-09-21T19:26:50+00:00\",\"dateModified\":\"2022-09-27T06:25:01+00:00\",\"author\":{\"@id\":\"https:\/\/legalvision.co.uk\/#\/schema\/person\/46d22f7d1b4ba321fe5b1cdc648cc5d2\"},\"description\":\"Your business must respond to a Subject Action Request in a timely manner. We explain how long your business has to respond to a SAR.\",\"breadcrumb\":{\"@id\":\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#breadcrumb\"},\"mainEntity\":[{\"@id\":\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#faq-question-1663785721433\"},{\"@id\":\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#faq-question-1663785780289\"}],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#primaryimage\",\"url\":\"https:\/\/img.legalvision.com.au\/wp-content\/uploads\/sites\/4\/2022\/05\/24121449\/business-image-052244.jpg\",\"contentUrl\":\"https:\/\/img.legalvision.com.au\/wp-content\/uploads\/sites\/4\/2022\/05\/24121449\/business-image-052244.jpg\",\"width\":775,\"height\":517,\"caption\":\"UCTA 1977: Legal Considerations for Small Businesses | LegalVision UK\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/legalvision.co.uk\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Data, Privacy and IT Articles\",\"item\":\"https:\/\/legalvision.co.uk\/category\/data-privacy-it\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"How Long Does My Business Have to Respond to a Subject Access Request in England?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/legalvision.co.uk\/#website\",\"url\":\"https:\/\/legalvision.co.uk\/\",\"name\":\"LegalVision UK\",\"description\":\"LegalVision is a commercial law firm in the UK with a commitment to innovation\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/legalvision.co.uk\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/legalvision.co.uk\/#\/schema\/person\/46d22f7d1b4ba321fe5b1cdc648cc5d2\",\"name\":\"Thomas Sutherland\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/legalvision.co.uk\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/legalvision.co.uk\/wp-content\/uploads\/sites\/4\/2022\/05\/cropped-Thomas-Sutherland-96x96.jpg\",\"contentUrl\":\"https:\/\/legalvision.co.uk\/wp-content\/uploads\/sites\/4\/2022\/05\/cropped-Thomas-Sutherland-96x96.jpg\",\"caption\":\"Thomas Sutherland\"},\"description\":\"Tom is an Expert Legal Contributor for LegalVision. He has particular expertise in Commercial and Employment litigation, as well as data protection and privacy regulations. He is a qualified Solicitor in England and Wales and has a decade of legal experience, including advocacy within civil courts and Tribunals. Tom specialises in civil and employment litigation. He has extensive experience in advising employers and companies as to the requirements of employment law and data protection rules, as well as day-to-day advice on smooth running from a commercial perspective. Qualifications: Professional Skills Course - Law, University of Law; Legal Practice Course - Law, College of Law; Bachelor of Laws, University of Southampton.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/tom-sutherland-72b4509b\/\"],\"url\":\"https:\/\/legalvision.co.uk\/author\/thomassutherland\/\"},{\"@type\":\"Question\",\"@id\":\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#faq-question-1663785721433\",\"name\":\"What information can my business refuse to provide when it faces a SAR?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"When responding to a SAR, your business can refuse to provide information related to individuals other than the author and documents that record protected legal advice (known as the \u2018legal professional privilege\u2019 exception).\",\"inLanguage\":\"en-GB\"},\"inLanguage\":\"en-GB\"},{\"@type\":\"Question\",\"@id\":\"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#faq-question-1663785780289\",\"name\":\"Can my business refuse to carry out a SAR?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Only very occasionally can your business refuse to provide a SAR, and it can be risky to do so. The primary example would be when an individual makes two SAR requests and asks for the same information in both. Your company could state they will concentrate on the first request but ignore the second SAR because it is an unnecessary repetition of the first.\",\"inLanguage\":\"en-GB\"},\"inLanguage\":\"en-GB\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How Should My Business Respond to a SAR? | LegalVision UK","description":"Your business must respond to a Subject Action Request in a timely manner. We explain how long your business has to respond to a SAR.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/","og_locale":"en_GB","og_type":"article","og_title":"How Should My Business Respond to a SAR? | LegalVision UK","og_description":"Your business must respond to a Subject Action Request in a timely manner. We explain how long your business has to respond to a SAR.","og_url":"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/","og_site_name":"LegalVision UK","article_publisher":"https:\/\/www.facebook.com\/LegalVision","article_published_time":"2022-09-21T19:26:50+00:00","article_modified_time":"2022-09-27T06:25:01+00:00","og_image":[{"width":775,"height":517,"url":"https:\/\/img.legalvision.com.au\/wp-content\/uploads\/sites\/4\/2022\/05\/24121449\/business-image-052244.jpg","type":"image\/jpeg"}],"author":"Thomas Sutherland","twitter_card":"summary_large_image","twitter_creator":"@LegalVision_law","twitter_site":"@LegalVision_law","twitter_misc":{"Written by":"Thomas Sutherland","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#article","isPartOf":{"@id":"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/"},"author":{"name":"Thomas Sutherland","@id":"https:\/\/legalvision.co.uk\/#\/schema\/person\/46d22f7d1b4ba321fe5b1cdc648cc5d2"},"headline":"How Long Does My Business Have to Respond to a Subject Access Request in England?","datePublished":"2022-09-21T19:26:50+00:00","dateModified":"2022-09-27T06:25:01+00:00","mainEntityOfPage":{"@id":"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/"},"wordCount":1210,"image":{"@id":"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#primaryimage"},"thumbnailUrl":"https:\/\/img.legalvision.com.au\/wp-content\/uploads\/sites\/4\/2022\/05\/24121449\/business-image-052244.jpg","keywords":["small business","gdpr","ICO","data protection rules","SAR"],"articleSection":["Data, Privacy and IT Articles"],"inLanguage":"en-GB"},{"@type":["WebPage","FAQPage"],"@id":"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/","url":"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/","name":"How Should My Business Respond to a SAR? | LegalVision UK","isPartOf":{"@id":"https:\/\/legalvision.co.uk\/#website"},"primaryImageOfPage":{"@id":"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#primaryimage"},"image":{"@id":"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#primaryimage"},"thumbnailUrl":"https:\/\/img.legalvision.com.au\/wp-content\/uploads\/sites\/4\/2022\/05\/24121449\/business-image-052244.jpg","datePublished":"2022-09-21T19:26:50+00:00","dateModified":"2022-09-27T06:25:01+00:00","author":{"@id":"https:\/\/legalvision.co.uk\/#\/schema\/person\/46d22f7d1b4ba321fe5b1cdc648cc5d2"},"description":"Your business must respond to a Subject Action Request in a timely manner. We explain how long your business has to respond to a SAR.","breadcrumb":{"@id":"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#breadcrumb"},"mainEntity":[{"@id":"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#faq-question-1663785721433"},{"@id":"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#faq-question-1663785780289"}],"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#primaryimage","url":"https:\/\/img.legalvision.com.au\/wp-content\/uploads\/sites\/4\/2022\/05\/24121449\/business-image-052244.jpg","contentUrl":"https:\/\/img.legalvision.com.au\/wp-content\/uploads\/sites\/4\/2022\/05\/24121449\/business-image-052244.jpg","width":775,"height":517,"caption":"UCTA 1977: Legal Considerations for Small Businesses | LegalVision UK"},{"@type":"BreadcrumbList","@id":"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/legalvision.co.uk\/"},{"@type":"ListItem","position":2,"name":"Data, Privacy and IT Articles","item":"https:\/\/legalvision.co.uk\/category\/data-privacy-it\/"},{"@type":"ListItem","position":3,"name":"How Long Does My Business Have to Respond to a Subject Access Request in England?"}]},{"@type":"WebSite","@id":"https:\/\/legalvision.co.uk\/#website","url":"https:\/\/legalvision.co.uk\/","name":"LegalVision UK","description":"LegalVision is a commercial law firm in the UK with a commitment to innovation","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/legalvision.co.uk\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/legalvision.co.uk\/#\/schema\/person\/46d22f7d1b4ba321fe5b1cdc648cc5d2","name":"Thomas Sutherland","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/legalvision.co.uk\/#\/schema\/person\/image\/","url":"https:\/\/legalvision.co.uk\/wp-content\/uploads\/sites\/4\/2022\/05\/cropped-Thomas-Sutherland-96x96.jpg","contentUrl":"https:\/\/legalvision.co.uk\/wp-content\/uploads\/sites\/4\/2022\/05\/cropped-Thomas-Sutherland-96x96.jpg","caption":"Thomas Sutherland"},"description":"Tom is an Expert Legal Contributor for LegalVision. He has particular expertise in Commercial and Employment litigation, as well as data protection and privacy regulations. He is a qualified Solicitor in England and Wales and has a decade of legal experience, including advocacy within civil courts and Tribunals. Tom specialises in civil and employment litigation. He has extensive experience in advising employers and companies as to the requirements of employment law and data protection rules, as well as day-to-day advice on smooth running from a commercial perspective. Qualifications: Professional Skills Course - Law, University of Law; Legal Practice Course - Law, College of Law; Bachelor of Laws, University of Southampton.","sameAs":["https:\/\/www.linkedin.com\/in\/tom-sutherland-72b4509b\/"],"url":"https:\/\/legalvision.co.uk\/author\/thomassutherland\/"},{"@type":"Question","@id":"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#faq-question-1663785721433","name":"What information can my business refuse to provide when it faces a SAR?","acceptedAnswer":{"@type":"Answer","text":"When responding to a SAR, your business can refuse to provide information related to individuals other than the author and documents that record protected legal advice (known as the \u2018legal professional privilege\u2019 exception).","inLanguage":"en-GB"},"inLanguage":"en-GB"},{"@type":"Question","@id":"https:\/\/legalvision.co.uk\/data-privacy-it\/sar-request-business\/#faq-question-1663785780289","name":"Can my business refuse to carry out a SAR?","acceptedAnswer":{"@type":"Answer","text":"Only very occasionally can your business refuse to provide a SAR, and it can be risky to do so. The primary example would be when an individual makes two SAR requests and asks for the same information in both. Your company could state they will concentrate on the first request but ignore the second SAR because it is an unnecessary repetition of the first.","inLanguage":"en-GB"},"inLanguage":"en-GB"}]}},"_links":{"self":[{"href":"https:\/\/legalvision.co.uk\/api\/wp\/v2\/posts\/176002","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/legalvision.co.uk\/api\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/legalvision.co.uk\/api\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/legalvision.co.uk\/api\/wp\/v2\/users\/13349"}],"replies":[{"embeddable":true,"href":"https:\/\/legalvision.co.uk\/api\/wp\/v2\/comments?post=176002"}],"version-history":[{"count":13,"href":"https:\/\/legalvision.co.uk\/api\/wp\/v2\/posts\/176002\/revisions"}],"predecessor-version":[{"id":176110,"href":"https:\/\/legalvision.co.uk\/api\/wp\/v2\/posts\/176002\/revisions\/176110"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/legalvision.co.uk\/api\/wp\/v2\/media\/3104"}],"wp:attachment":[{"href":"https:\/\/legalvision.co.uk\/api\/wp\/v2\/media?parent=176002"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/legalvision.co.uk\/api\/wp\/v2\/categories?post=176002"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/legalvision.co.uk\/api\/wp\/v2\/tags?post=176002"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}