Subject Access Request (SAR) refusal letter template

£9.99
UK-specific Editable Instant download 12 months' updates

This Subject Access Request (SAR) Refusal Letter provides a formal response where an organisation has decided that it cannot comply with all or part of a subject access request because a specific legal exemption or the manifestly unfounded or excessive provisions apply. It records the reason for refusal and explains the individual's rights to challenge the decision.

Use this template to:

  • Confirm that a subject access request has been considered
  • Explain why all or part of the request cannot be complied with
  • Identify the relevant exemption or legal basis for refusal
  • Provide a clear record of the organisation's reasoning
  • Explain the individual's complaint and challenge rights
  • Maintain an appropriate audit trail for the SAR decision
Subject Access Request (SAR) refusal letter template
2026 Reviewed
Get the complete resource

Don't just buy one template — get the complete Data access and privacy templates toolkit

If you are managing employee data access and privacy, the toolkit brings together practical HR templates covering requests, verification, review, response and record keeping.

8 templates • £24.99 • 12 months' access & updates
View the complete toolkit

What's included in this template?

This template brings together the key information, sections and considerations you need to create a clear, comprehensive and professional HR document. Preview the document below.

  • SAR acknowledgement and decision
  • Scope of the refusal
  • Relevant exemption or legal basis
  • Reasons supporting the decision
  • ICO and complaint information
  • Internal review and judicial remedy information
Template

Download .doc

Copy [to paste]

Email

[Sender name]

[Sender address]

[date]

[Recipient name]

[Recipient address]

 

Dear [Recipient first name],

Subject Access Request

Thank you for your Subject Access Request dated [Date], in which you requested access to your personal information held by [Company Name].

We have carefully considered your request and the information covered by it.

Following our assessment, we are unable to comply with [all / part] of your request in relation to the information described below.

Information to which the refusal applies

The information affected by this decision is:

[Describe the information or category of information being withheld without disclosing information that would undermine the exemption or restriction being relied upon.]

[Where the refusal is partial: The remainder of the information covered by your request will be provided separately / has been provided with this response.]

Reason for refusal

We are relying on [insert relevant exemption / provision] because [set out the specific reason why the exemption applies in this case].

[Where relying on legal professional privilege: The

PREVIEW ENDS HERE

This is the end of the preview

You've seen 30% of how the Subject Access Request (SAR) refusal letter template is structured. Get the complete editable template instantly and customise it for your organisation.

£9.99
Specifications
Access 12 months, with updates
Length 2 pages • 488 words
Jurisdiction England, Wales, Scotland
Based on UK law, ACAS guidance
Last review 23/09/2026
Next review 23/03/2027
Delivery Instant digital delivery
Formats .doc · .txt · email

What is a subject access request (SAR) refusal letter?

Subject Access Request (SAR) refusal letter template preview

This letter provides a structured response where an organisation decides that it cannot comply with all or part of a subject access request. It is designed for situations where a specific exemption applies or where the request is manifestly unfounded or excessive and the organisation has documented evidence supporting that conclusion.

Recording the SAR decision

The letter confirms that the organisation has considered the request and clearly identifies whether the refusal applies to the whole request or only particular information. This helps distinguish a genuine refusal from a delay or incomplete response.

Explaining the legal basis

The organisation should identify the applicable exemption or other lawful basis for withholding the information. The wording should be tailored to the circumstances rather than relying on a generic statement that the request cannot be fulfilled.

Providing reasons

Where information is withheld, the organisation should explain its reasoning to the extent that doing so does not itself undermine the purpose of the exemption. For manifestly unfounded or excessive requests, the organisation should have clear evidence supporting the decision.

Dealing with partial refusals

A refusal does not necessarily need to apply to the entire SAR. Where some personal information can properly be provided, the organisation should consider whether the request can be complied with in part while withholding only information covered by an applicable exemption.

Explaining challenge rights

The response should tell the individual how they can complain to the organisation, complain to the Information Commissioner's Office and, where applicable, seek to enforce their rights through the courts.

Example

An employee submitted a SAR requesting all personal information held by their employer, including correspondence between the company and its solicitors concerning an ongoing employment dispute. The organisation carried out a reasonable search and identified personal information that could be disclosed as well as legally privileged communications.

The employer did not refuse the entire SAR. It provided the employee with the personal information to which they were entitled but withheld specific material covered by legal professional privilege.

The response letter explained that the relevant information was being withheld under the applicable data protection exemption. It did not disclose details that would undermine the purpose of the exemption, but provided sufficient information about the decision to explain why the material had not been included.

The employee was informed of their right to complain to the organisation and the ICO and of their ability to seek a judicial remedy. The employer retained a record of the searches undertaken, the information withheld, the exemption relied upon and the reasoning behind the decision.

The wider HR process

Related HR resources and workflow

Explore the HR resources that may be relevant before and / or after using the Subject Access Request (SAR) refusal letter, helping you understand the wider process, maintain appropriate documentation and follow a consistent approach.

Previous
Forms
Subject Access Request (SAR) form

A standardised form for employees to use when submitting a SAR.

This
Subject Access Request (SAR) refusal letter
Next
Letters
Employee appeal (general) letter

Our Employee Appeal Letter Template provides a structured format for employees to appeal decisions, ensuring clarity and fairness in the process.

Premium content

To continue reading, purchase this item or a parent toolkit, library or our full library.

Implementation guidance

Use these best practice actions, recommended timescales and process stages to understand when and how the Subject Access Request (SAR) refusal letter should be used, helping ensure each step is handled consistently and appropriately documented.

Step Description Responsibility Timing
1 Review the SAR, identify the information requested and determine whether the request can be complied with fully, partially or whether a refusal may be justified. HR / Data Protection Lead As soon as possible
2 Carry out appropriate searches and identify any information that may be subject to an exemption or restriction. Document the searches and decision-making process. HR / Data Protection Lead / IT Within the SAR response period
3 Assess the proposed refusal against the applicable legal requirements and ensure there is sufficient evidence to justify withholding the information. Data Protection Lead / Legal Adviser Before refusal is issued
4 Issue the refusal letter, explaining the scope and reason for refusal and providing the individual's applicable complaint and challenge rights. Data Protection Lead / HR Within 1 month unless a lawful extension applies
5 Retain the SAR decision record, including searches, exemptions considered, information withheld and reasons for the decision, and respond appropriately to any review or complaint. Data Protection Lead / HR Immediately / ongoing
Premium content

To continue reading, purchase this item or a parent toolkit, library or our full library.

Common mistakes

Understand the common mistakes to avoid when using this HR template, helping you reduce risk, prevent unnecessary costs and ensure the process is handled correctly.

  • Refusing a SAR simply because it is large, inconvenient or connected to an employment dispute
  • Using a blanket policy that treats repeat requests as automatically excessive
  • Failing to distinguish a full refusal from information that can still be disclosed
  • Relying on an exemption without documenting why it applies
  • Providing insufficient information about the individual's rights to challenge the decision
  • Failing to retain evidence supporting the refusal decision
Premium content

To continue reading, purchase this item or a parent toolkit, library or our full library.

HR considerations

UK employment law and best practice

This template is designed to support the process, but the document should be used alongside the relevant HR procedure and applied to the circumstances of the individual case.

Right of access

Individuals have a right to access their personal information and obtain a copy of it, subject to applicable exemptions and restrictions. Organisations must make a reasonable and proportionate search for the requested information and normally respond without undue delay and within one month. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/

Refusing a SAR

An organisation can only refuse to provide information where an applicable exemption or restriction applies. The ICO states that a SAR can be refused wholly or partly where it is manifestly unfounded or excessive, but there is a high threshold for relying on these provisions. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/right-of-access/when-can-we-consider-a-sar-to-be-manifestly-unfounded-or-excessive/

Manifestly unfounded requests

A request may be manifestly unfounded where the individual clearly has no intention of exercising their right of access or where the request is clearly malicious and is being used to harass or cause disruption. The assessment must be made on the circumstances of the individual request and supported by clear evidence. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/right-of-access/when-can-we-consider-a-sar-to-be-manifestly-unfounded-or-excessive/

Manifestly excessive requests

A request may be manifestly excessive where it is clearly or obviously unreasonable, taking account of all the circumstances. Relevant factors can include the nature of the information, the burden involved, previous requests, overlap with other requests and whether a reasonable interval has elapsed. A request is not automatically excessive merely because it covers a large amount of information. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/right-of-access/when-can-we-consider-a-sar-to-be-manifestly-unfounded-or-excessive/

Partial refusals and exemptions

An organisation should consider whether information can be disclosed even where other information must be withheld. The UK GDPR and Data Protection Act 2018 contain a range of exemptions and restrictions, including provisions relating to legal professional privilege, information about other people, crime and taxation and certain management information. The appropriate exemption must be assessed on the facts of the case. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/

Information about other people

A SAR may contain personal information relating to other individuals. An organisation does not generally have to disclose information that identifies another person unless the relevant conditions for disclosure are met. This does not necessarily mean that an entire document must be withheld if the requester's own information can be disclosed appropriately. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/

Legal professional privilege

Information that is legally privileged may be exempt from the right of access. Where legal professional privilege is relied upon, the organisation should identify the exemption appropriately and document the basis for applying it. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/

Reasons and challenge rights

Where an organisation refuses to comply with a SAR, it must explain the reasons for the decision, subject to any restrictions on providing that information. It must also inform the individual of their right to complain to the ICO and their ability to seek to enforce their rights through the courts. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/

Response timescales

An organisation normally has one month from receipt of a valid SAR to respond. The period can be extended by up to a further two months where the request is complex or multiple requests have been received, provided the individual is informed within the first month and the reason for the extension is explained. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/

You may also need these resources

FAQs

Can an employer refuse an employee's SAR?

Yes, but only where a relevant exemption or restriction applies. A complete refusal is relatively unusual. The employer should first consider whether some or all of the requested personal information can be provided.

Can an employer refuse a SAR because it is very large?

Not automatically. A large request is not necessarily excessive. The employer should consider whether the request is clearly or obviously unreasonable in the circumstances and should consider reasonable and proportionate searches before relying on the manifestly excessive provision.

Can a SAR be refused because the employee is involved in an employment dispute?

Not simply for that reason. The ICO specifically indicates that the fact a requester may intend to use information in litigation does not, by itself, justify refusing a SAR. The employer must consider whether a specific exemption or other lawful basis applies.

Does the employer have to explain why information has been withheld?

Generally, the organisation should explain the reasons for refusing all or part of a request and identify the relevant exemption where appropriate. However, there are circumstances where providing detailed reasons could undermine the purpose of the exemption, so the explanation should be tailored to the case.

What can an employee do if their SAR is refused?

The individual can complain to the organisation and can also complain to the Information Commissioner's Office. They may also have a right to seek a judicial remedy. The refusal letter should explain these rights.

Why use HRDocBox rather than AI?

HRDocBox templates are designed around practical UK HR processes and current data protection requirements. This template provides a structured framework for documenting a sensitive SAR refusal while allowing the organisation to tailor the legal basis and reasoning to the particular circumstances.

How this content is developed and reviewed

The Subject Access Request (SAR) refusal letter template is developed using a practical HR methodology that considers current UK employment legislation, ACAS guidance, CIPD good practice and the real-world HR process it supports. Templates and supporting information are regularly reviewed and updated, with additional reviews triggered by significant changes to legislation, guidance or established HR practice, helping ensure each document remains practical, relevant and suitable for UK employers.

About the author

Darryl Horn, Chartered HR Director

Darryl is a Chartered HR professional with over 25 years' experience in senior HR and employee relations roles.

He has extensive practical experience of managing data access and privacy HR processes and founded hrdocbox to provide businesses with practical, professionally developed HR resources grounded in UK employment law and best practice.

HRDocBox has been creating practical UK HR documents since 2009.

Executive recommendation

"Darryl provides support and advice with excellent judgement, and has a strong understanding of people, policies and UK employment legislation."

"He is someone I trust; consistent, dependable, and committed to doing things properly."

RB
Ruth Brock Chief Executive Officer The Hygiene Bank
Get started today

HR confidence starts here

Whether you employ 5 people or 50, hrdocbox gives you the structure, documents and expertise needed to manage employees professionally and legally.

Download your FREE UK employment contract template

Professionally written and fully compliant with UK employment law

Download FREE contract
Free UK employment contract template