Unlocking Transparency – a Primer on Managing Subject Access
21 October 2025
At Veritau, one of the most common types of queries we receive from clients is a request for personal information, also known as a Subject Access Request (SAR) or Data Subject Access Request (DSAR).
In this article, we will take a closer look at what a SAR is, the work it entails, and how we support our clients in processing this type of request.
What is a Subject Access Request (SAR)?
Under the UK GDPR, individuals have a legal right to request access to their own personal data when it is held by an organisation.
A SAR can be made either in writing or verbally to any staff member within an organisation.
The person submitting the request does not have to refer to the legislation for the request to be valid. Often, a request may be contained within a complaint or another type of communication. Therefore, it’s crucial to understand how to recognise a SAR. Veritau can advise you on this.
Subject access also gives data subjects the right to be:
- told whether any personal data of theirs is being processed;
- provided with a description of the personal data, the reasons for processing, and whether it has been shared with any other organisations or people; and
- provided with details of the source of the data.
Frequently Asked Questions
Below are some of the most frequently asked questions we receive regarding the processing of SARs:
Some of the records include information about other people as well as the data subject – do we have to provide it?
No – under data protection legislation, the data subject is only entitled to their own personal data, unless they are requesting the data on someone else’s behalf (such as a parent submitting the request on behalf of their child). Veritau can advise you on how to establish whether the applicant has a right of access to other individuals’ data.
Where there is no right of access, any third-party data should be redacted.
Can I withhold information about the data subject?
You can only withhold information where an appropriate exemption applies. There are a range of exemptions under the UK GDPR and the Data Protection Act 2018 which allow you to lawfully withhold information from disclosure.
What are the exemptions?
For the full list of exemptions, you can visit the ICO website here.
At Veritau, the most common exemptions we apply are:
- Third-party data – used to protect personal data about any individual that is not the data subject.
- Legal professional privilege – used to cover confidential communications made between the client and a legal professional when obtaining legal advice.
- Regulatory functions relating to legal services, the health service and children’s services – used to protect personal data where release would prejudice the consideration of complaints.
- Health, education and social work data – personal data within those three sectors could be exempt if it includes information processed by a court, or where release could cause serious harm.
- Child abuse data – you are exempt from providing child abuse data in response to a SAR if the data subject the abuse relates to did not submit the SAR, and the disclosure would not be in the best interests of the data subject.
- Confidential references – this applies to references provided in confidence.
- Negotiations – this exemption may be used for records requested during ongoing employee investigations or disciplinary proceedings.
Veritau’s SAR redaction service
Processing SARs and understanding data protection legislation can be daunting for some organisations. There are statutory timescales for responding to SARs and, as it can be a time-consuming process, this makes the work even more challenging.
As well as searching for and compiling the requested information, organisations must carefully review the data to ensure that the requester only receives the information they are entitled to.
Many organisations don’t have the necessary resources or expertise to undertake SARs properly and run the risk of not completing them properly or to the satisfaction of the data subject. There is also the added pressure of a data subject making a complaint. In the first instance this should be dealt with internally. However, if the data subject remains dissatisfied, they have the right to refer the matter to the Information Commissioner (the UK’s data protection regulator).
At Veritau, we work closely with our clients to ensure they are compliant with data protection legislation and understand the rules regarding the sharing of personal information.
We have a team of dedicated experts who can ensure that requests are completed within the statutory timescales, advise on appropriate exemptions, and ensure that the data subject only receives the personal information they are entitled to. We also liaise with the Information Commissioner on your behalf, where necessary, helping to simplify the process and ease the burden.
If you need support with a subject access request, contact us using the details below for a chat about how we can help:
[email protected] or call 01904 552848
