A request about personal data can be for a copy, a correction, erasure or any of the other rights, and the clock starts once identity is confirmed. This form logs the type of request, the due date and any extension, so each one is answered the same way and on time.
This form template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Form number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested form templates. No junk, jargon or unnecessary content. Simple and usable form templates
developed over 25 years through practical use in the real world.
Further guidance on data protection requests:
Download this form template with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This form is also included in the GDPR / Data Protection Toolkit and the ISO 22458 toolkit and the integrated toolkits that include it, so the toolkit route gives you this file plus everything else you need in one download.
If you'd like hands-on help setting up your process for handling personal data requests, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Subject Access Request Form Template
A form for logging and working through a request from an individual about their personal data - a request for a copy, or a request to use any of the other rights. It takes the request through three stages, the request details, the review and the response, recording who dealt with each stage and when.
What's Included in this Form
- Subject Access Request (SAR) Details - received by and date, the type of request (access, rectification, erasure, restriction, portability, objection or automated decisions), the data subject, request details and contact details
- SAR Review - authentication and authorisation, the date identity was confirmed and the time limit started, the response due date, any extension and the date the individual was told, an overview of the data held and the rights that apply
- SAR Response - date sent, an overview of the data provided, any information withheld and why, and how the data was provided
The form is marked Confidential, as it holds details of the individual and their request.
Who Needs a Subject Access Request Form?
Any organisation that holds personal data about customers, employees, job applicants or other contacts can receive a request and has to respond within the time limit.
Included in the GDPR / Data Protection Toolkit
This form is part of the GDPR / Data Protection Toolkit - the registers, forms, policies, procedure and guidance for documenting how you collect and process personal data, in one download, and is also included in the ISO 22458 toolkit.
Works with the Subject Access Request Policy
The P-93 Personal Data Subject Access Request Policy tells people how to make a request, and the PP-1-16 Data Protection Policy Procedure sets out how requests are handled internally. This form is the record of each one.
Using the Form
Start a form as soon as a request is received, whether it arrives by email, letter, phone or in person. Confirm the person's identity, record the date the time limit starts and the response due date, and work through the review before responding. Keep the completed form as the record of the request.
Searching AI Records
When searching for the personal data held, include records created by AI tools - meeting transcripts and summaries, prompts and outputs, and chatbot conversations - as well as email, files and business systems.
Recording What Was Withheld
Where information is withheld, for example because it includes other people's personal data, the form records what was withheld and why, so the decision can be explained if the person complains.
Related Documents
Other documents in the GDPR / Data Protection Toolkit that work alongside this one:
Keeping Requests on Time
Recording the response due date and any extension on the form makes it easy to see which requests are open and when each is due, so nothing runs past the time limit.
Would you rather we prepared it for you?
Our Personal Data Register and Privacy Notice Preparation service works through the personal data your organisation holds with you, including the AI tools in use, and prepares the register and privacy notice so they describe what actually happens to that data.
Personal Data Register and Privacy Notice Preparation