Subject Access Request (SAR) acknowledgment letter template

£9.99
UK-specific Editable Instant download 12 months' updates

This Subject Access Request (SAR) Acknowledgement Letter confirms receipt of a request for personal information and explains the next steps in the organisation’s response process. It provides a clear written record of the request, expected response timescale and any information that may be required before the request can be processed.

Use this template to:

  • Confirm that a subject access request has been received
  • Record the date the request was received
  • Explain the expected response timescale
  • Request appropriate identification or clarification where necessary
  • Explain that information will be reviewed before disclosure
  • Provide a clear and professional first response to the requester
Subject Access Request (SAR) acknowledgment letter template
2026 Reviewed
Get the complete resource

Don't just buy one template — get the complete Data access and privacy templates toolkit

If you are managing employee data access and privacy, the toolkit brings together practical HR templates covering requests, verification, review, response and record keeping.

8 templates • £24.99 • 12 months' access & updates
View the complete toolkit

What's included in this template?

This template brings together the key information, sections and considerations you need to create a clear, comprehensive and professional HR document. Preview the document below.

  • Confirmation that the SAR has been received
  • Date the request was received and response deadline
  • Optional request for identity verification
  • Optional request for clarification of the information sought
  • Explanation of the review and disclosure process
  • Contact details and next steps
Template

Download .doc

Copy [to paste]

Email

[Sender name]

[Sender address]

[date]

[Recipient name]

[Recipient address]

 

Dear [Recipient first name],

Subject Access Request

Thank you for your [email / letter / request] received on [Date], in which you have requested access to personal information held by [Company Name].

We confirm that we have received your Subject Access Request and will now process it in accordance with our data protection obligations.

Response timescale

We will normally provide our response without undue delay and within one month of receiving your request, subject to any applicable requirements relating to identity verification or clarification of your request.

Based on the date we received your request, we currently expect to provide our response by [Response Date].

Where the request is complex or you have made a number of requests, the applicable response

PREVIEW ENDS HERE

This is the end of the preview

You've seen 30% of how the Subject Access Request (SAR) acknowledgment letter template is structured. Get the complete editable template instantly and customise it for your organisation.

£9.99
Specifications
Access 12 months, with updates
Length 2 pages • 379 words
Jurisdiction England, Wales, Scotland
Based on UK law, ACAS guidance
Last review 23/09/2026
Next review 23/03/2027
Delivery Instant digital delivery
Formats .doc · .txt · email

What is a subject access request (SAR) acknowledgment letter?

Subject Access Request (SAR) acknowledgment letter template preview

This letter provides a clear and professional acknowledgement when an individual makes a Subject Access Request (SAR). It confirms that the request has been received and sets out what the requester can expect while the organisation identifies, searches for and reviews relevant personal information.

Confirming receipt

A prompt acknowledgement helps establish a clear audit trail and gives the requester confidence that their request has been identified and passed to the appropriate person or team for handling.

Setting out the response timescale

The letter provides the expected date for the response. Under current data protection requirements, organisations normally have one month to respond to a SAR, although the timeframe can be extended by up to a further two months where the request is complex or the individual has made a number of requests.

Checking identity and clarifying the request

Where reasonably necessary, the organisation can request proportionate information to confirm the requester’s identity. It may also seek clarification where the request is sufficiently broad or unclear that an effective search cannot reasonably be completed without further information.

Explaining what happens next

The acknowledgement can explain that relevant systems and records will be searched and that information will be reviewed before disclosure. This helps manage expectations without suggesting that every document located will automatically be provided.

Creating a clear audit trail

Keeping a copy of the acknowledgement with the SAR record provides evidence of when the request was received, what information was requested from the individual and how the response process was managed.

Example

An employee sends an email to HR asking for a copy of all personal information held about them, including their HR records, emails and correspondence relating to their employment. HR recognises the email as a Subject Access Request and records the date it was received.

HR sends an acknowledgement confirming receipt and explains that the organisation will normally respond within one month. The acknowledgement also explains that the organisation may contact the employee if it needs reasonable clarification or proportionate evidence of identity before completing the request.

HR then coordinates the search across the relevant HR records, email systems and other appropriate sources. Information relating to other individuals is reviewed separately, and any applicable exemptions or redactions are considered before the response is issued.

The acknowledgement provides a useful audit trail because it records when the request was received, what the employee was told about the process and the expected response date. The final SAR response is then issued securely within the applicable timescale.

The wider HR process

Related HR resources and workflow

Explore the HR resources that may be relevant before and / or after using the Subject Access Request (SAR) acknowledgment letter, helping you understand the wider process, maintain appropriate documentation and follow a consistent approach.

Previous
Forms
Subject Access Request (SAR) form

A standardised form for employees to use when submitting a SAR.

This
Subject Access Request (SAR) acknowledgment letter
Next
Letters
Subject Access Request (SAR) Response letter

This template provides a formal response to the SAR, confirming the information that will be provided, any exemptions applied, and details of how the information will be delivered (e.

Premium content

To continue reading, purchase this item or a parent toolkit, library or our full library.

Implementation guidance

Use these best practice actions, recommended timescales and process stages to understand when and how the Subject Access Request (SAR) acknowledgment letter should be used, helping ensure each step is handled consistently and appropriately documented.

Step Description Responsibility Timing
1 Recognise and record the SAR, including the date received and the identity of the requester. HR / Data Protection Lead Same day or as soon as possible
2 Send the acknowledgement and confirm the expected response date based on the applicable statutory timescale. HR / Data Protection Lead Within 1–2 working days
3 Request proportionate identification or clarification promptly if either is reasonably required to process the request. HR / Data Protection Lead As soon as identified
4 Coordinate a reasonable and proportionate search, followed by review of information for third-party information, exemptions and appropriate redactions. HR / Data Protection Lead / Relevant system owners During the response period
5 Provide the SAR response securely and retain an appropriate record of the request, searches, decisions and response. HR / Data Protection Lead Normally within 1 month
Premium content

To continue reading, purchase this item or a parent toolkit, library or our full library.

Common mistakes

Understand the common mistakes to avoid when using this HR template, helping you reduce risk, prevent unnecessary costs and ensure the process is handled correctly.

  • Failing to acknowledge a SAR promptly or record when it was received
  • Automatically requesting formal identification when the requester’s identity is already sufficiently clear
  • Giving an inaccurate or unnecessarily rigid response deadline
  • Suggesting that all information held will automatically be disclosed
  • Failing to ask for genuinely necessary clarification early enough
  • Sending the response or personal information through an insecure method
Premium content

To continue reading, purchase this item or a parent toolkit, library or our full library.

HR considerations

UK employment law and best practice

This template is designed to support the process, but the document should be used alongside the relevant HR procedure and applied to the circumstances of the individual case.

Right of access

Individuals have a right to obtain a copy of their personal information and certain supplementary information. A SAR does not need to use specific wording or refer to data protection legislation to be valid. Requests may be made verbally or in writing.

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/

Response timescale

Organisations must normally respond to a SAR without undue delay and within one month of receipt. The response period can be extended by up to a further two months where the request is complex or the individual has made a number of requests. Where an extension is required, the requester should be informed within the initial one-month period and told why more time is needed.

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/

Identity verification

An organisation can request information to verify identity where reasonably necessary. Any verification should be proportionate to the circumstances and organisations should avoid unnecessary delays in processing the request.

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/

Clarifying a request

Where a request is sufficiently unclear or broad that the organisation cannot reasonably identify the information required, it may ask the requester for clarification. Under current ICO guidance, where clarification is reasonably required, the response timeframe can be paused until the requester responds.

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/

Searching and reviewing information

Organisations should carry out a reasonable and proportionate search for relevant personal information. Information should be reviewed before disclosure, including consideration of information relating to other individuals and any applicable exemptions or restrictions.

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/

Secure disclosure

Personal information should be provided in a clear and accessible form and appropriate steps should be taken to ensure that the information is disclosed securely to the correct person.

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/

You may also need these resources

FAQs

Does a Subject Access Request have to be made in writing?

No. A SAR can be made verbally or in writing, including by email or other communication methods. The individual does not have to use the words “Subject Access Request” or refer to the UK GDPR.

Why should an employer send an acknowledgement?

An acknowledgement creates a clear record that the request has been received, confirms who is dealing with it and helps establish the expected response date. The ICO recommends acknowledging requests electronically or in writing.

Can the employer ask for identification?

Yes, where reasonably necessary to confirm the requester’s identity. The request for identification should be proportionate. If the employer is already confident about the person’s identity, additional formal identification may not be necessary.

Can the employer ask the employee to narrow their request?

The employer can ask for clarification where it is reasonably required to deal with the request effectively. However, a requester cannot simply be required to narrow a valid request because responding to it would be inconvenient or time-consuming.

Does acknowledging the SAR mean that everything requested will be disclosed?

No. The acknowledgement confirms receipt and explains the process. Relevant information must still be identified and reviewed, including consideration of third-party information, applicable exemptions and appropriate redactions before disclosure.

Why use HRDocBox rather than AI?

HRDocBox templates provide structured, practical HR documents designed around UK employment and HR requirements. They give employers a starting point that can be adapted to their own procedures, rather than relying on an AI-generated document that may require significant checking, restructuring and legal review.

How this content is developed and reviewed

The Subject Access Request (SAR) acknowledgment letter template is developed using a practical HR methodology that considers current UK employment legislation, ACAS guidance, CIPD good practice and the real-world HR process it supports. Templates and supporting information are regularly reviewed and updated, with additional reviews triggered by significant changes to legislation, guidance or established HR practice, helping ensure each document remains practical, relevant and suitable for UK employers.

About the author

Darryl Horn, Chartered HR Director

Darryl is a Chartered HR professional with over 25 years' experience in senior HR and employee relations roles.

He has extensive practical experience of managing data access and privacy HR processes and founded hrdocbox to provide businesses with practical, professionally developed HR resources grounded in UK employment law and best practice.

HRDocBox has been creating practical UK HR documents since 2009.

Executive recommendation

"Darryl provides support and advice with excellent judgement, and has a strong understanding of people, policies and UK employment legislation."

"He is someone I trust; consistent, dependable, and committed to doing things properly."

RB
Ruth Brock Chief Executive Officer The Hygiene Bank
Get started today

HR confidence starts here

Whether you employ 5 people or 50, hrdocbox gives you the structure, documents and expertise needed to manage employees professionally and legally.

Download your FREE UK employment contract template

Professionally written and fully compliant with UK employment law

Download FREE contract
Free UK employment contract template