F-Q73 Subject Access Request
| File Reference : | F-Q73 Personal Data - Subject Access Request |
Under the UK GDPR, anyone whose personal data you hold can ask to see it, and you normally have one month to respond. This form works a request through in three stages - logging what was asked for, reviewing the data held and the person's identity and rights, and recording what was provided - so every request is handled the same way and on time.
This form template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Form number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested form templates. No junk, jargon or unnecessary fields. Simple and usable form templates
developed over 25 years through practical use in the real world. No AI generated nonsense here!
Further guidance on data protection and subject access requests:
Download this form template with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This form is also included in the GDPR & Data Protection Toolkit and every alphaZ ISO toolkit that covers information security and data protection, so the toolkit route gives you this file plus everything else you need in one download.
If you'd like hands-on help setting up your data protection records and subject access request process, or your wider information security management system, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Subject Access Request Form Template
A subject access request (SAR) form for logging and working through a request from an individual to see the personal data you hold about them. It takes the request through three stages - the request details, an internal review of the data held and the requester's identity and rights, and the response issued - with space to record who dealt with each stage and when.
The right of access is set out in Article 15 of the UK GDPR and the Data Protection Act 2018. An organisation must respond to a valid request, normally within one month, confirm what personal data it holds and why, and provide a copy. This form gives you a repeatable way to meet that obligation and to evidence that each request was handled properly.
Built for the UK GDPR Right of Access
The form captures what a subject access request needs at each stage:
- The request itself - who made it, when it was received and by whom, and what has been asked for
- Identity and authorisation - a check that the requester is who they say they are, or is authorised to act on someone's behalf
- Data held and rights - an overview of the personal data held and the data subject rights that apply
- The response - an overview of the data provided, how it was provided and the date it was sent
What's Included in this Subject Access Request Form
The form is set out in three stages so a request can be logged, reviewed and answered in one place:
- SAR Details - received by and date received, the data subject name, the request details and contact details
- SAR Review - completed by and date, authentication and authorisation of the data subject, an overview of the data held and the rights that apply
- SAR Response - completed by and date sent, an overview of the data provided and how any data was provided
Who Needs a Subject Access Request Form?
Any organisation that holds personal data about individuals - customers, employees, suppliers or enquirers - can receive a subject access request and has to respond to it. A simple, consistent form matters most for smaller businesses without a dedicated data protection team, and for anyone maintaining data protection compliance or an information security management system aligned with ISO 27001.
Included in the GDPR & Data Protection Toolkit
This form is part of the GDPR & Data Protection Toolkit - the registers, forms, policies and guidance for documenting how you collect and process personal data in one download - and is included in the alphaZ ISO 27001 Toolkit for information security.
Pairs with the Personal Data Breach Form
Where handling a request or any other event uncovers a problem with personal data, the F-Q74 Personal Data Breach Form records and assesses a personal data breach and whether it needs reporting to the ICO.