SAR Support for SMEs
Subject access request (SAR) support for SMEs is essential to ensuring that you comply with your legal requirements while minimising disruption to your business. When a SAR is received, you generally have one calendar month to comply with it. Unless you have a full-time, dedicated data protection officer (DPO), this usually means diverting staff from the activities that keep you in business. As a Data Access Office subscriber you can entrust the complete process to us and focus on running your business.
We act as your Data Protection Officer
Data Access Office provides end-to-end support for small and medium size enterprises. Your cases will be led by a qualified data protection officer (DPO) from start to finish. We carry out an initial review to assess scope, complexity and proportionality of the request, coordinate the collation and upload of relevant documents into our secure online case management portal, and draft and manage all correspondence on your behalf.
Where requests are broad or unclear, we advise on lawful refinements and exemptions, including:
- pausing the statutory response clock where appropriate
- assessing whether an extension is justified
- applying “manifestly excessive or unfounded” provisions when time and resource thresholds are met.
The result is a compliant, defensible outcome with minimal disruption to your day-to-day operations. And, most importantly, a process that feels controlled, supported and complete.
Subject Access Requests FAQs
Anyone that you may hold information about can make a request to see that information. This is known as a data subject access request (DSAR) or subject access request (SAR). The person may be a past or present customer or employee, supplier. If you hold information about the people that your business engages with, they have a right of access to see that information.
There is no formal process for making a subject access request (SAR). It can be done in writing, over the telephone, or in person. People can even make the request over social media. There is no specific wording that has to be used and the request doesn’t have to be addressed to a specific person or postholder within your business.. A request is valid if it is clear that someone is requesting their personal information.
People may also ask a third party such a friend, family member, or solicitor to make the request on their behalf. There are also online services that offer to manage requests on behalf of individuas. In these cases it is the responsibility of the person making the request to prove they are authorised to act on someone else’s behalf.
Yes. In cases of children making a request you need to consider their competence to make a SAR and whether they understand their right,s There is no age limit set out by law. Children may also ask a parent or guardian or other third party to make the request on their behalf. As long as they supply evidence that they are authroised to act on the child’s behalf, you should honour the request.
You must respond to a subject access request “without undue delay and at the latest within one month of receiving the request”. If you require clarification of what information they require, you pause the one month ‘clock’ when you ask for clarification and resume the ‘clock’ once clarification is received. Your request for clarification must be reasonable. For example, because you hold a lot of information about them or if their request is vague or unclear. You cannot force someone to narrow the scope of their request.
If the same person has made multiple subject access requests to you, or the request is complex, then you may extend the timeframe by up to an additional two months. If you extend the timeframe, you must tell the requester within the first month.
The process of what happens when a Subject Access Request is received
- Request receivedWe draft and manage the initial response, acknowledging receipt and setting the process in motion.
- Secure document collation
Relevant data is identified, collated, and securely uploaded into our online case management system.
- Expert review & scope assessment
A qualified Data Protection Officer (DPO) reviews the materials and advises on scope, exemptions, or refinement.
- Lawful extenstion of the deadline
We will extend the one month deadline in cases that are complex or when multiple requests from the same person have been received.
- Redaction & response preparation
Documents are reviewed, lawfully redacted, and prepared into a compliant response pack.
- Final delivery
The SAR is issued on your behalf with full audit trails.
✔ Deadline met
✔ Risk reduced
✔ Client reassured 😊
Nervous about when an SAR Lands?
A Calm guide — from start to finish
When a Subject Access Request lands, the first concern is usually “What do I do now?”.
Data Access Office removes that uncertainty. From day one, you are supported by a qualified Data Protection Officer who explains the process in clear terms and manages the response on your behalf.
We take care of drafting responses, gathering information, reviewing documents, and communicating professionally with the requestor. If a request is unclear, overly broad, or disproportionate, we advise on lawful refinement — including pausing the response deadline where permitted, assessing extensions, or applying exemptions when appropriate. You are never left guessing what is happening or why.
Everything is managed through our secure online case management system, giving you visibility, structure, and reassurance throughout. By the time the SAR is delivered, you know it has been handled carefully, compliantly, and defensibly — without stress, disruption, or last-minute surprises.
Get in touch
