Data subject access requests

New and updated

• Type:

  Employment law guide

  Data protection: data subject rights

  Updated to reflect new requirements from 19 June 2026 for handling data protection complaints, including the obligation on employers to have the means to facilitate complaints, and to respond without undue delay.

• Type:

  How to

  How to respond to subject access requests from employees under the UK GDPR

  New rules on data protection complaints are introduced by the Data (Use and Access) Act 2025, from 19 June 2026. When an employer responds to a data subject access request, it is required to inform the employee of their right to complain to the employer. Employers must have procedures in place for responding to complaints.

• Type:

  Letters and forms

  Letter refusing subject access request or asking for administrative fee

  This template letter has been updated to reflect new requirements from 19 June 2026 for handling data protection complaints, including making clear that individuals can complain to the organisation as well as to the Information Commissioner’s Office.

• Type:

  Letters and forms

  Letter responding to subject access request providing requested information

  This template letter has been updated to reflect new requirements from 19 June 2026 for handling data protection complaints, including making clear that individuals can complain to the organisation as well as to the Information Commissioner’s Office.

• Type:

  Policies and procedures

  Data protection policy

  Use our updated template wording to review and amend your organisation’s data protection policy to reflect new requirements from 19 June 2026 for handling data protection complaints.

• Type:

  FAQs

  What data subject access rights do employees have under the UK GDPR?

  Updated to reflect new rules on time limits for responding to data subject access requests, in place from 5 February 2026 under the Data (Use and Access) Act 2025.

• Type:

  Legal timetable

  Requirement for data protection complaints procedure

  The Data (Use and Access) Act 2025 introduces a requirement for organisations to have a data protection complaints procedure in place.

• Type:

  Letters and forms

  Letter responding to subject access request asking for more information

  Updated to take account of verbal subject access requests, which ICO guidance states are valid.

• Type:

  Letters and forms

  Letter extending time to respond to subject access request

  Updated to take account of verbal subject access requests, which ICO guidance states are valid.

• Type:

  Letters and forms

  Form for individual to make subject access request

  Updated to take account of verbal subject access requests, which ICO guidance states are valid.