Subject Access Requests Inside an Active Documentation Engagement

A subject access request under UK GDPR entitles the data subject to a copy of personal data the engagement holds about them, together with information about how that data is processed. The response is documented and delivered within the statutory time limit from the verified request.

Verification of the requester is the first step. A request from an unverified channel is not actioned. The engagement records the identification documents provided, the verification method, and the operator who confirmed the requester's identity before the request enters the response queue.

Scope clarification follows where the initial request is broad. The engagement may ask the requester to specify a time period, a document category, or a relationship, and the request and clarification exchange are recorded as part of the response file rather than treated as informal correspondence.

Third-party data inside the file is handled carefully. Where a document contains personal data of someone other than the requester, the engagement redacts the third-party data unless a lawful basis to disclose exists. The redaction log records what was removed and the basis for removal.

Exemptions are applied transparently. A document withheld under a statutory exemption is recorded as withheld, with the exemption named, so a later regulator query can be answered against a documented basis rather than reconstructed from memory of the response decision at the time.

Response delivery is logged. The channel, the format, the date sent, and the recipient confirmation are recorded against the request so the engagement can evidence compliance with the statutory deadline if a complaint follows the response or if the requester re-opens the matter later.

Repeat requests are answered against the same standards. The engagement does not apply higher friction to a subsequent request from the same subject, but does record the cumulative pattern, since manifestly unfounded or excessive requests carry a documented right of refusal or fee.

Our scope is to respond on the documented basis. We do not adjudicate disputes between the data subject and the client, do not represent either party to the ICO, and do not waive the engagement's own access controls in response to informal pressure outside the documented request channel.