A subject access request can be verbal or written and need not use the term SAR. It concerns the person's personal information and required supplementary information, not automatically every unredacted document in the property file.
Recognise and scope the request
- Record when it arrived and what information the person seeks.
- Check identity proportionately and verify a representative's authority where needed.
- The ordinary response limit is one month without undue delay. Check the current rules for necessary clarification, identity evidence and any extension rather than inventing a new start date.
Search and review
- Include relevant tenancy records, rent notes, repairs, emails, messages and agent information.
- Use a reasonable and proportionate search and record where you looked.
- Review other people's information and applicable exemptions carefully. Redact only on a justified basis, preserving a record of the decision.
Respond clearly and securely
- Provide the information in an accessible form with the required explanation.
- Where a justified complexity or multiple-request extension is needed, notify and explain it within the required period.
- Verify the recipient and delivery method and keep the final disclosed version.
Example: the request arrives as a complaint
A fictional tenant writes, “Send me all the information you hold about me.” Recognise the data request within the complaint and start the response process. It should not wait indefinitely for the ordinary complaint to be closed.
What to do
- Record the request and promptly resolve necessary identity or authority checks.
- Search relevant systems and review third-party information and exemptions.
- Respond securely within the applicable period and keep a disclosure record.
Evidence to keep
- Original request, date calculation and any justified clarification.
- Search log, review decisions, response and secure delivery evidence.
Sources and guidance
- Subject access requests and the right of accessInformation Commissioner's Office · checked 20 October 2026
- Data protection advice for small organisationsInformation Commissioner’s Office · checked 20 October 2026