A subject access request (SAR) from a client, former client or employee must be answered without undue delay and within one month of receipt, usually free of charge, with a copy of the person’s personal data and the supplementary information set out in UK GDPR. The deadline can be extended to three months for complex requests, and information can be withheld only where a specific exemption applies, such as the crime and taxation exemption or the rights of third parties.

What counts as a subject access request?

The ICO’s guide to subject access says a request can be made verbally or in writing, including through social media. It is valid if it is clear the person wants their own personal information; they do not have to use any particular words, mention the law, or send it to a particular contact. A solicitor, relative or online portal can make the request for someone else, but it is for the third party to show it has authority.

In a practice, requests tend to arrive in three ways:

  • a former client in a fee dispute, often asking for “everything you hold about me”;
  • a departing or dismissed employee, usually ahead of an employment claim;
  • an individual connected to a client, such as an employee on a payroll the firm runs or a spouse whose income appears in a joint file.

Because a request can be made to anyone in the firm, every member of staff needs to recognise one and pass it on the same day. The right belongs to living individuals; a limited company client has no right of access, although its directors can ask for their own personal data.

How long does the firm have to respond?

The response is due without undue delay and at the latest within one month. The ICO’s detailed right of access guidance explains how to count it:

  • Start on the day the request (or requested ID or authority) is received, even if that is not a working day, and run to the same date in the following month.
  • If that date does not exist, use the last day of the month, so 31 January runs to 28 February (29 in a leap year).
  • If the deadline falls on a weekend or public holiday, it moves to the end of the next working day.
  • A firm that wants a fixed number of days for its systems could use 28 days, which always falls within a calendar month.

The deadline can be extended by up to two further months if the request is complex or the person has made a number of requests, calculated as three months from the original start date. The person must be told about the extension, with reasons, within the first month. A request is not complex simply because it involves a lot of information or because a processor holds the data.

If the firm genuinely needs to know which information is wanted, it can ask for clarification and the clock stops on the day it asks, restarting the day after the answer arrives. The ICO says this should not be done on a blanket basis, and the requester cannot be forced to narrow the request. Where a request repeats “everything”, the firm must still carry out a reasonable search. Since the Data (Use and Access) Act 2025, the ICO’s guidance confirms that searches need only be reasonable and proportionate.

Can the firm ask for ID or charge a fee?

The firm can ask for identification if it is not sure who is asking, but should only ask for what is reasonable and proportionate. A known client writing from the email address on file usually needs no formal ID. The clock does not start until requested ID arrives, so ask straight away.

In most cases no fee can be charged. A reasonable fee for administrative costs is allowed only where the request is manifestly unfounded or excessive, or for further copies. The ICO describes the threshold for refusing a request as manifestly unfounded or excessive as high.

What has to be sent?

The person is entitled to confirmation that their data is being processed, a copy of it, and supplementary information. The ICO lists that supplementary information as the purposes, the categories of data, the recipients, the retention period or criteria, the rights to rectification, erasure, restriction and objection, the right to complain to the firm and to the ICO, the source of data not collected from the person, any automated decision making, and safeguards for overseas transfers. Most of this is already in the firm’s privacy notice, which can be linked to.

If the request came electronically, the copy must be provided in a commonly used electronic format, and the person should not have to buy software to open it. It must be sent securely; the ICO gives the example of an encrypted file with the access code sent separately. The firm does not have to create new documents, and can provide extracts rather than whole files.

A SAR gives a copy of personal data, not the return of a client’s original records. Where the firm is exercising a lien over papers, see our page on liens over client records.

Which exemptions are most relevant to a practice?

Exemptions must be considered case by case and the reasons documented. Those that come up most in accountancy work are:

  • Crime and taxation. Information processed for preventing or detecting crime or for assessing or collecting tax can be withheld only to the extent disclosure is likely to prejudice those purposes. This is the exemption to consider where the firm has made a suspicious activity report; see our page on tipping off. The ICO accepts that where saying an exemption has been applied would itself cause prejudice, the response can be more general.
  • Information about other people. Data that would reveal another individual need not be disclosed unless that person consents or it is reasonable to disclose without consent. Joint files and staff emails often raise this.
  • Negotiations with the requester. A record of the firm’s intentions in negotiations, such as an internal note of the lowest fee it would accept to settle a dispute, is exempt to the extent disclosure would prejudice the negotiations.
  • Confidential references. References given or received about a person’s employment or services are exempt.
  • Management information. Data used for management forecasting or planning, such as restructuring plans, is exempt where disclosure would likely prejudice the business.
  • Legal professional privilege. This covers confidential communications with a professional legal adviser, such as advice the firm took from its solicitors about a claim.

If the firm refuses all or part of a request, it must tell the person why, and explain their right to complain to the firm, to the ICO and to seek enforcement through the courts.

How should an employee request be handled?

Employee requests are usually the largest, because they reach into email, HR files, timesheets and partner discussions. Agree the search terms and systems early, record the searches made, and review results for colleagues’ personal data and for privileged or negotiation material before release. Asking for clarification is legitimate where the firm holds a large volume of information and the request is unclear, but it does not let the firm avoid a reasonable search. A firm must also not require a job applicant to obtain records about themselves through a SAR as a condition of employment; the ICO notes that an enforced SAR is a criminal offence.

How does the timetable work in practice?

Illustration only. A former client emails the firm on Friday 20 November 2026 asking for all personal data held about him. The one month period runs to 20 December 2026, a Sunday, so the response is due by the end of Monday 21 December 2026. The partner decides the request is complex because years of archived files must be restored, and emails the client on 1 December explaining why. The extended deadline is three months from 20 November, which is Saturday 20 February 2027, so the response must go by the end of Monday 22 February 2027. An internal file note recording the fee the firm would accept to settle the dispute is withheld under the negotiations exemption, and the response says that some information has been withheld and explains the client’s right to complain.

What mistakes do firms make?

  • Treating a request as invalid because it did not mention the law or came by phone or social media.
  • Starting the clock when the partner reads the email rather than when the firm received it.
  • Extending the deadline after the first month has passed, or without telling the requester why.
  • Withholding a whole file under the crime and taxation exemption without assessing prejudice item by item.
  • Sending unencrypted files or a proprietary format the person cannot open.
  • Ignoring the separate duty to deal with data protection complaints, which the ICO says must be acknowledged within 30 days; our page on client complaints procedures covers how to run that alongside the firm’s general process.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.