Access request handling: documents to prepare
Access request handling begins the moment a data subject asks what personal data an organisation holds about them. The team must verify identity, locate every relevant record, and log the request before drafting a response. Missing a document at this stage costs more time than the review that follows.
How the process unfolds
Every request moves through the same sequence, regardless of size. Intake starts the clock. Verification confirms who is asking and what they actually want. Search and collection pull the records together. Review removes anything that should not leave the organisation. The final package closes the file.
| Stage | What happens | Typical duration |
|---|---|---|
| Intake and logging | The request is entered in a case register and the sender's identity is queried if it is unclear | 1–2 days |
| Verification | Identity documents are checked and the scope of the request is confirmed with the requester | 2–5 days |
| Search and collection | Records are pulled from every system that might hold personal data, including backups and archives | 5–15 days |
| Review and redaction | Third-party data and confidential material are removed before disclosure | 3–7 days |
| Response and closure | The final package is sent and the case is logged for audit purposes | 1–2 days |
Documents to prepare
Before the search stage starts, a short set of documents should already exist. Without them, verification stalls and the search becomes unfocused.
- Request log entry with date received and channel used
- Identity verification record, including any documents checked
- Data inventory or records map covering the systems in scope
- Search confirmation signed off by each system owner
- Redaction and third-party data decision log
- Draft response letter, reviewed before sending
- Final response with delivery confirmation
Where the data sits inside a vendor's platform, the same discipline applies on the technology side: How open source compliance review technology contract documents to shows the parallel checklist for that layer.
If the personal data flows through more than one supplier, the file grows accordingly. Supply change procedure: documents to prepare covers the equivalent structure for a changing supply chain.
Who handles the request and decides outcomes
The person responsible for data protection within the organisation decides the scope of disclosure and any grounds for withholding part of the file. That decision should be recorded, not just communicated verbally. If the requester disagrees with the outcome, the matter can be raised with the organisation internally first, and then with the relevant national supervisory authority if it remains unresolved.
If the situation differs
The stages above assume a straightforward request with one requester and one organisation. Several variations change the sequence.
If the requester has already contacted a regulator before the internal process finished, the timeline compresses and the file needs to be ready sooner than usual. When the other side moved first in this situation walks through that sequence.
If the request lands while a contract involving the data is itself being wound down, the closing file and the access response need to be prepared together. Termination and wind-down sets out that closing file.
The point of no return
Once the deadline for a first substantive response passes without any communication, the organisation loses the option to negotiate an extension informally. From that point, the requester is entitled to escalate, and any later response is read against a record that already shows delay. Sending a short holding notice before the deadline, even without the full file, keeps the process inside a negotiable stage.
What this page does not cover
This page describes the sequence, the documents, and the decision points. It does not set out how long a specific deadline is under any particular regime, because that depends on the applicable rules for the organisation's sector and location. It also does not cover what happens once a request turns into a formal complaint before a court or tribunal.
Related publications
For the underlying schedule that determines how long records exist to be found in the first place, see Retention schedule design.
Verified
This procedure reflects standard practice for handling access requests inside an organisation and is reviewed periodically against operational experience. It does not rely on a single external source; readers checking a specific statutory deadline should confirm it against the rules that apply to their own sector and location.
FAQ
- How long does access request handling take in practice?
- Most requests close within three to four weeks once intake, verification, search, review, and response are all counted together. Complex requests spanning several systems or departments take longer.
- Which documents are needed to start?
- A logged request entry and an identity verification record are the minimum. Without both, the search stage should not begin, because scope and requester are not yet confirmed.
- What happens if the other side does not respond?
- If the requester does not answer a scope clarification, the case can be paused and logged as pending, with the pause itself recorded and dated for the file.
Where a subcontractor abroad already holds part of the personal data in question, the access request and the vendor relationship need handling together: When the outsourcing provider subcontracts abroad in practice.