Subject Access Request (SAR) Procedure template
Documented procedure for handling UK GDPR Article 15 Subject Access Requests. Covers identity verification, 1-month response deadline, data gathering, redaction of third-party information, exemptions, and ICO escalation. Reduces risk of ICO enforcement action.
Generate your subject access request (sar) procedure in minutes
Answer a few questions about your business and PolicyKit produces a tailored, professionally structured document — ready to export as PDF or Word.
Generate freeAbout this document
A subject access request, or SAR, procedure sets out how an organisation responds when individuals ask for the personal data held about them. It defines the steps for verifying, locating, and providing that information within the required timeframe. A clear procedure helps handle requests consistently and on time.
Who needs one: Any organisation that processes personal data and must respond to individuals’ access requests.
What a strong subject access request (sar) procedure covers
- How requests are received and recognised
- Verifying the identity of the requester
- Locating and collating the relevant personal data
- Applying exemptions and redactions where appropriate
- Response timeframes and how information is provided
- Record-keeping and handling of complex requests
Regulations and frameworks this aligns to
PolicyKit references the standards relevant to your jurisdiction when it generates your subject access request (sar) procedure.
- UK GDPR
- The retained UK version of the General Data Protection Regulation, governing how organisations process the personal data of people in the UK.
- GDPR
- The EU General Data Protection Regulation, governing how organisations collect, use, and protect personal data of people in the EU.
- Data Protection Act 2018
- The UK statute that supplements and implements data protection law alongside the UK GDPR, including law-enforcement and intelligence-service processing.
Frequently asked questions
What should a subject access request (sar) procedure include?
A robust subject access request (sar) procedure sets out scope, roles and responsibilities, the specific controls or procedures involved, and how compliance is monitored and reviewed, mapped to frameworks like uk-gdpr, gdpr, dpa-2018. PolicyKit structures all of this automatically based on your business.
Is this legal advice?
No. PolicyKit generates AI-assisted professional templates and starting points, not legal advice. Every document should be reviewed with qualified legal and compliance counsel before use.
Can I tailor it to my country?
Yes — PolicyKit tailors each document to your jurisdiction, including UK, EU, United States, Australia, Singapore, Hong Kong and more.
You may also need
Cybersecurity & Information Security
Protect your systems, networks, and data from cyber threats. Aligned with NIST Cybersecurity Framework and Cyber Essentials.
Data Protection & Privacy
Manage personal data lawfully and transparently. Covers GDPR, UK GDPR, and US privacy law (CCPA/CPRA) requirements.
Acceptable Use & Access Control
Define how employees and contractors may use company systems, devices, and data — and who can access what.
Incident Response
Prepare for, detect, contain, and recover from security incidents and personal data breaches. Includes breach notification obligations.
Ready to create your subject access request (sar) procedure?
Start freePolicyKit provides AI-assisted templates and starting points, not legal advice.