How to use

Follow these steps

1. 1

   Log the request

   Date received, requester name, contact details, what was asked for. The 30-day clock starts on receipt — including weekends.

2. 2

   Verify the requester''s identity

   Proportionate verification — typically a copy of ID plus proof of address, or matching them against existing records. Don''t over-ask: requesting unnecessary information is itself a GDPR concern.

3. 3

   Define the search scope

   What systems hold their data? Email, CRM, payroll, file storage, support tickets. Capture every place that needs searching.

4. 4

   Conduct the search

   Use the requester''s name, email, phone, and any other identifiers. Save the search criteria — supervisors ask how the search was scoped.

5. 5

   Review for exemptions and third-party data

   Some data is exempt (legal privilege, management information, references). Where another individual''s data appears, redact or ask their consent before disclosure.

6. 6

   Compile and deliver the response

   Provide the data in a commonly-used format, with a covering letter explaining: what processing is being done, who you share data with, retention, the requester''s rights, and how to complain to the ICO.

7. 7

   Issue within 30 days

   30 days from receipt. You can extend by up to 60 days for complex requests but must notify the requester within the first month with a reason.

8. 8

   Log the resolution

   Date completed, what was disclosed, any redactions or exemptions applied. ICO can request this log on an investigation.