How do I handle a Subject Access Request?

A Subject Access Request (SAR) is a formal request from an individual to receive a copy of the personal data you hold about them. Under GDPR Article 15, you must respond within one calendar month. DataShield HQ helps you track each SAR from receipt to completion.

Steps

1. Log in to your DataShield HQ workspace.
2. Click Subject Requests in the left-hand navigation menu.
3. Click + New Request.
4. Fill in the request details:
   • Data Subject – Link to an existing data subject record, or create a new one.
   • Request Type – Select Subject Access Request.
   • Received Date – The date the request was received (this starts the 30-day clock).
   • Due Date – Auto-calculated as 30 days from received date. Adjust if the deadline is extended.
   • Notes – Any relevant context about how the request was received.
5. Click Save. The request is now tracked in your SAR list.
6. Work through your internal process to gather and review all data held on the subject.
7. When ready to respond, update the request status to In Progress, then Completed once the response has been sent.

Deadline Rules

• You have 30 calendar days from receipt to respond.
• If the request is complex or you have received a large number of requests, you can extend by a further 2 months — but you must notify the subject within the first month.
• You cannot charge a fee for a SAR unless the request is manifestly unfounded or excessive.

Tip

Use the Audit Log to document every action you take in response to a SAR. This creates a defensible record if the subject or a regulator questions your response.