Libraries
760+ HR templates
Everything your business needs to stay compliant
Policies, contracts, letters, guidance and HR support tools for UK employers.
View full libraryPolicies, contracts, letters, guidance and HR support tools for UK employers.
View full libraryThis Subject Access Request (SAR) Policy sets out how the organisation will recognise, record, investigate and respond to requests from individuals seeking access to their personal information. It provides a clear process for managing SARs consistently, securely and within the applicable UK data protection requirements.
Use this policy to:
-policy-template.jpg "Subject Access Request (SAR) policy template")
If you are strengthening information security, these security and information policy templates give you a practical set of policies covering information handling, access, employee responsibilities, monitoring and leavers.
This template brings together the key information, sections and considerations you need to create a clear, comprehensive and professional HR document. Preview the document below.
1 Overview
1.1 [Company Name] recognises that individuals have rights under UK data protection law to access personal information held about them.
1.2 This policy sets out how [Company Name] will recognise, record, investigate and respond to Subject Access Requests (SARs) in a consistent, secure and timely manner.
1.3 The organisation will seek to provide individuals with the information to which they are entitled while protecting confidential information, the rights of other individuals and information that is subject to applicable exemptions or restrictions.
2 Scope
2.1 This policy applies to all employees and workers of [Company Name] and to other individuals whose personal information is processed by the organisation where the right of access applies.
2.2 It applies to SARs relating to information held in any relevant format or system, including:
3 General principles
3.1 What is a Subject Access Request?
3.1.1 A Subject Access Request is a request by an individual for access to their personal information.
3.1.2 A valid SAR does not need to use the words "Subject Access Request", "SAR", "right of access" or "Article 15". It may be made verbally or in writing and may be received through any part of the organisation.
3.1.3 Examples include:
3.2 Recognising a SAR
3.2.1 All employees should understand that a request for personal information may constitute a SAR even if the requester does not use formal data protection terminology.
3.2.2 Where an employee receives a potential SAR, they should not attempt to deal with it themselves. They should forward it promptly to [SAR Contact / HR / Data Protection Lead].
3.2.3 Managers should not search through their own records and provide information directly to an employee without following the organisation's SAR process.
3.3 Making a SAR
3.3.1 Individuals may make a SAR:
3.3.2 Requests should be directed to:
[SAR Contact Name / Team]
[Email Address]
[Postal Address if applicable]
However, a request sent to another employee or department must still be recognised
You've seen 20% of how the Subject Access Request (SAR) policy template is structured. Get the complete editable template instantly and customise it for your organisation.
-policy-template-preview.jpg "Subject Access Request (SAR) policy template preview")
This policy provides a practical framework for handling subject access requests across the organisation. It is particularly relevant to employers because employee SARs can involve HR files, emails, performance records, absence information, investigation documents, payroll information and other sources containing personal data.
A SAR does not need to use the words "subject access request" or refer to data protection legislation. A request can be verbal or written and can be made to any part of the organisation if it is clear that the individual is asking for access to their personal information.
The policy establishes a central process for recording requests, checking identity where necessary, clarifying the scope where appropriate, allocating responsibility and monitoring the statutory response deadline. It helps prevent requests from being overlooked when they are received by managers or other employees.
A reasonable and proportionate search should be undertaken for information within scope. Depending on the circumstances, this may involve HR systems, personnel files, email, messaging systems, shared drives, absence records, performance records and other relevant information sources.
Information should be reviewed to identify personal information belonging to the requester and any information that may be subject to an exemption or restriction. Information relating to other people may require particular consideration, and appropriate redaction may sometimes allow information to be disclosed while protecting other individuals.
The response should be clear, accessible and provided securely. Where information is withheld or the request is refused, the organisation should record the reason and applicable exemption or restriction and explain the individual's available complaint and challenge rights, subject to any legal restrictions on disclosure.
Use these best practice actions, recommended timescales and process stages to understand when and how the Subject Access Request (SAR) policy should be used, helping ensure each step is handled consistently and appropriately documented.
Understand the common mistakes to avoid when using this HR template, helping you reduce risk, prevent unnecessary costs and ensure the process is handled correctly.
A SAR is a request from an individual for access to their personal information. It does not have to use the words "Subject Access Request" or refer to data protection law. For example, an employee asking for their HR file or information held about their performance may have made a SAR.
Yes. A SAR can be made verbally or in writing, including through electronic communications or social media. The organisation should have a process for recording verbal requests and referring them to the person responsible for handling SARs.
The normal response period is one month from receipt. This can be extended by up to a further two months where the request is complex or multiple requests have been received, provided the individual is informed within the first month and the reason for the extension is explained.
An employer can ask for clarification where this would help identify the information the employee wants, particularly where the request is broad. However, an individual is not generally required to narrow a valid SAR simply because the organisation would prefer a narrower request.
No, not simply for that reason. The existence of an employment dispute does not remove the individual's right of access. The organisation must consider whether any specific exemption or restriction applies to the information requested.
HRDocBox policies are designed around practical UK HR processes and current data protection requirements. This policy provides a structured framework covering the end-to-end SAR process, including employee requests, searches, exemptions, redaction, secure disclosure and record keeping, rather than relying on a generic AI-generated policy.
How this content is developed and reviewed
The Subject Access Request (SAR) policy template is developed using a practical HR methodology that considers current UK employment legislation, ACAS guidance, CIPD good practice and the real-world HR process it supports. Templates and supporting information are regularly reviewed and updated, with additional reviews triggered by significant changes to legislation, guidance or established HR practice, helping ensure each document remains practical, relevant and suitable for UK employers.
Darryl Horn, Chartered HR Director
Darryl is a Chartered HR professional with over 25 years' experience in senior HR and employee relations roles.
He has extensive practical experience of managing security and information HR processes and founded hrdocbox to provide businesses with practical, professionally developed HR resources grounded in UK employment law and best practice.
HRDocBox has been creating practical UK HR documents since 2009.
"Darryl provides support and advice with excellent judgement, and has a strong understanding of people, policies and UK employment legislation."
"He is someone I trust; consistent, dependable, and committed to doing things properly."
Whether you employ 5 people or 50, hrdocbox gives you the structure, documents and expertise needed to manage employees professionally and legally.
Professionally written and fully compliant with UK employment law
Access a free contract template instantly - or save 10% on any document today.
Use this code at checkout for 10% off anything!
Includes instant download, updates, and full access to your HR templates.
