Subject Access Request SAR Responses | General Data Protection Regulation GDPR | Acknowledgement and Partial Exemption | Template for FCA Applications and Authorised Firms

Subject Access Request Acknowledgment

[Send as soon as the SAR is received]

[Subject Name]
[Subject Address]
[Enter Date]

Dear [Enter Name]

Thank you for recent your [letter/email] received on [date] requesting access to personal information regarding [subject].

We aim to process the request as soon as possible and certainly within 30-days from the date the request was received. You will therefore hear from us no later than [insert date 30-days after request receipt].

If for any reason we are unable to provide the requested information within this timeframe, we will inform you immediately, providing a full explanation for the delay.

In the interim if you have any queries, please do not hesitate to contact me.

Yours sincerely,

[Enter Name Data Protection Officer/Appointed Person]

[Enter Job title of person handling the request]

[Enter direct dial, email, extension]

Subject Access Response

[Enclose copies of any information being processed and your SAR Procedures for reference to the other rights and lodging a complaint.]

[Subject Name]
[Subject Address]
[Enter Date]

Dear [Enter Name]

Further to your recent access request, please find enclosed copies of all personal information relating to you that is currently being stored or processed by [Your Company Name].

In accordance with the [General Data Protection Regulation/Data Protection Act 2018], we have provided further information below regarding the processing of your personal information.

• [insert the purposes of the processing]
• [insert the categories of personal data concerned]
• [insert the recipient(s) to whom the personal data has/will be disclosed]
• [if applicable, provide details of any recipients in third countries or international organisations; as well as the appropriate safeguards used]
• [insert retention period or criteria used to determine that period]
• [if applicable, provide details of the source of the personal data if not collected directly from the data subject]
• [if applicable, provide details of the existence of automated decision-making, the logic involved and the significance and the envisaged consequences of such processing for the data subject.]

As per data protection law, you have the right to request the rectification of any inaccurate or incomplete data held by us. Details of how to notify us of any inaccuracies can be found in the enclosed Subject Access Request Procedures, along with further information about your other rights.

If you are unsatisfied with our actions or wish to make a complaint, you can contact us using the details enclosed. You also have the right to lodge a complaint with the Supervisory Authority, whose details have been provided in our Subject Access Request Procedures.

Yours sincerely,

(enclose SAR Procedures and copies of all relevant personal information)

[Enter Name Data Protection Officer/Appointed Person]

[Enter Job title of person handling the request]

[Enter direct dial, email, extension]

Subject Access Response – Partial Exemption

[Enclose copies of any information being processed and your SAR Procedures for reference to the other rights and lodging a complaint.]

[Subject Name]
[Subject Address]
[Enter Date]

Dear [Enter Name]

Further to your recent access request, please find enclosed [some/most] of the information requested by you. We have [not been able to provide/have redacted] some of the information requested because [insert Article 23 exemption/restriction and/or reasons for not providing all information].

In accordance with the [General Data Protection Regulation/UK Data Protection Law], we have provided further information below regarding the processing of your personal information.

• [insert the purposes of the processing]
• [insert the categories of personal data concerned]
• [insert the recipient(s) to whom the personal data has/will be disclosed]
• [if applicable, provide details of any recipients in third countries or international organisations; as well as the appropriate safeguards used]
• [insert retention period or criteria used to determine that period]
• [if applicable, provide details of the source of the personal data if not collected directly from the data subject]
• [if applicable, provide details of the existence of automated decision-making, the logic involved and the significance and the envisaged consequences of such processing for the data subject.]

As per the data protection law, you have the right to request the rectification of any inaccurate or incomplete data held by us. Details of how to notify us of any inaccuracies can be found in the enclosed Subject Access Request Procedures, along with further information about your other rights.

If you are unsatisfied with our actions or wish to make a complaint, you can contact us using the details enclosed. You also have the right to lodge a complaint with the Supervisory Authority, whose details have been provided in our Subject Access Request Procedures.

Yours sincerely,

(enclose SAR Procedures and copies of all relevant personal information)

[Enter Name Data Protection Officer/Appointed Person]

[Enter Job title of person handling the request]

[Enter direct dial, email, extension]

Denied Access Request Due To Exemption

[Send within one month of receipt of access request]

[Subject Name]
[Subject Address]
[Enter Date]

Dear [Enter Name]

Thank you for recent your [letter/email] received on [date] requesting access to personal information regarding [subject].

Unfortunately, we cannot provide the information requested due to [insert Article 23 exemption/restriction and/or reasons for not providing the requested information].

Under the [General Data Protection Regulation/Data Protection Act 2018], you have the right to lodge a complaint with the Supervisory Authority and to seek a judicial remedy. Details of how to contact the Supervisory Authority are provided below.

The Information Commissioner’s Office (ICO) can be contacted at: –

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Telephone: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

Fax: 01625 524 510

Email: enquiries@ico.org.uk

Yours sincerely,

[Enter Name Data Protection Officer/Appointed Person]

[Enter Job title of person handling the request]

[Enter direct dial, email, extension]

Delayed Access Request Response

[Send within 30-days of receipt of access request]  

[Subject Name]
[Subject Address]
[Enter Date]

Dear [Enter Name]

Further to your [letter/email] received on [date] requesting access to your personal information, due to the [complexity/volume] of the requested information, we will not be able to process your request within the originally stated 30-day timeframe.

y is [insert reason(s) for the delay]. However, we aim to process the request as soon as possible and certainly by [insert date (date request received + 90 days] at the latest.

In the interim if you have any queries, please do not hesitate to contact me.

Yours sincerely,

[Enter Name Data Protection Officer/Appointed Person]

[Enter Job title of person handling the request]

[Enter direct dial, email, extension]