A Subject Access Request (SAR, or DSAR) is different from an FOI request. Under UK GDPR and the Data Protection Act 2018, any individual can ask your council for a copy of the personal data you hold about them — and your council, as a data controller, must respond. It’s one of the most common data-protection duties small councils face, and one of the easiest to get wrong under time pressure.

What the requester is entitled to

A valid SAR asks for the person’s own personal data. They’re entitled to:

  • confirmation that you hold personal data about them;
  • a copy of that data; and
  • supplementary information (why you hold it, who you share it with, how long you keep it).

A request can arrive by any means — a letter, an email, even a verbal request — and doesn’t have to say “subject access request”. If someone asks for “everything you have about me”, treat it as a SAR.

The one-month deadline

You must respond without undue delay and within one calendar month of receiving the request. The month runs from the day you receive it (or the day you receive enough information to identify the requester and locate the data).

  • You can extend by a further two months if the request is complex or you’ve received several from the same person — but you must tell them, within the first month, that you’re extending and why.
  • The response is normally free. You can only charge a “reasonable fee”, or refuse, where a request is manifestly unfounded or excessive — a high bar you should document carefully.

The part that catches councils out: other people’s data

A SAR entitles the requester to their data, not everyone else’s. Minutes, email threads and complaint files often contain third-party personal data. Before you release anything you must redact information that would identify other people, unless they’ve consented or it’s reasonable to disclose. Rushing this is how councils accidentally cause a data breach while answering a data request.

A clean process

The failures the ICO sees are familiar: a request sat in a personal inbox, a month miscounted, or third-party data released by accident. The fix is a repeatable process — log it, run the clock, gather the data from one place, redact, record what was sent.

How Town Desk handles this

A Subject Access Request is logged the same way, under Governance → Requests, as a DSAR — it gets a SAR- reference and the one-month deadline is calculated automatically from the date received. The data subject’s details, the status (received → in progress → responded) and every action live on the request’s timeline, so the clock and the paper trail look after themselves. Redacting other people’s data is still your judgement call — but with resident data in one place, finding what you hold is far quicker.

See the governance features, or book a demo to walk through a request end to end.

General information for UK town & parish councils, not legal advice. For the authoritative position see the Information Commissioner’s Office (ICO) guidance on the right of access.