Assess the request, scope, and response period

Assess a new subject access request, agree its scope, and confirm the response period before work begins.

What this task achieves

Assessment turns a recorded request into a case your team can act on: you confirm what is actually being asked, decide whether any clarification is genuinely needed, and establish the response period that applies. Getting this right early prevents wasted searching and protects the statutory deadline.

Before you begin

You need the Member or Admin role to act on a case. Open the case — usually at status New — and have the original request wording in front of you in the Request Description.

Confirm what is being requested

Read the Request Description and check it faithfully reflects what the person asked for.
Check the request type is right. A subject access request is an Access request; erasure, rectification, portability, restriction, and objection are separate rights with their own guidance in Other data rights in DSAR Respond. A single message can exercise more than one right — record each one.
Note whether the person asked for everything you hold or for something specific, such as a date range, a topic, or a set of systems. If they asked for everything, that is the scope — you cannot require them to narrow it.
Record scope decisions and their reasons on the case, so later reviewers can see why the search covered what it did.

UK GDPR context

You may ask the requester to clarify what they want only when you process a large amount of information about them and genuinely need clarification to respond. A qualifying clarification request pauses the response period until the person replies; anything else — internal queries, delivery-format questions, general holds — does not. Clarification must never be used to delay or to pressure someone into narrowing their request: if they repeat or decline to narrow it, carry out a reasonable and proportionate search for everything. See Clarification, extensions, refusal, and specialist advice.

This is operational guidance for UK organisations, not legal advice.

Check the response period

DSAR Respond surfaces each case's calculated due date in several places: the Due Date column on the Dashboard, urgency badges (OVERDUE, URGENT, DUE SOON, ON TRACK, PAUSED), and the Needs Attention cards for overdue cases and cases approaching their deadline. Use these as workload signals — they are good at telling you which case to pick up next.

The legal position is set by the start event, not by the product display. For requests governed by the rules in force from 5 February 2026, the one-calendar-month response period runs from the latest of: receiving the request, receiving identity information you reasonably asked for, receiving evidence of a representative's authority you reasonably asked for, or receiving any permitted fee. Identity checks and their effect on the start of the period are covered in Verify identity or representative authority.

Confirm the statutory deadline yourself

DSAR Respond currently calculates the due date as the recorded received date plus one calendar month, in your organisation's timezone. That calculation does not yet reflect every lawful start event, qualifying clarification pause, or working-day adjustment under current UK rules, and it does not change when you request identity information or place a case on hold. Treat every displayed due date and urgency badge as a planning aid: confirm the response period against current ICO guidance, record the start event and your reasoning on the case, and diarise the statutory deadline independently. Respond without undue delay in any event — the deadline is an outer limit, not a target.

Place a case on hold

If work must pause — for example, you are waiting for a reply — you can change the case status to On Hold. The Place Case On Hold dialog asks for a Hold Reason (Awaiting Information, Third Party Delay, Legal Review, Data Subject Unresponsive, or Other) and optional Notes. While on hold, the product shows the case's clock as paused.

On Hold does not pause the legal clock

Placing a case On Hold pauses only DSAR Respond's own countdown. The statutory response period keeps running unless a qualifying clarification request applies. Never treat a product hold as extending the legal deadline — if you pause work, keep the real deadline in view and record why the pause was justified.

Extend the response deadline

An Admin can extend a case's deadline: on the case, select Extend Deadline to open the Extend Response Deadline dialog. Choose a Reason (Complex request, High volume of requests, Third-party delay, Legal review required, or Other (specify in notes)), set the New Deadline (the dialog allows up to two months beyond the current deadline), and add Notes where needed. Leave Send extension notice to data subject ticked unless you have a specific, recorded reason to notify the person another way — they must be told regardless.

UK GDPR context

An extension of up to two further months is available only where the request is complex or the person has made a number of requests. Size alone, or needing help from a processor, does not make a request complex. You must tell the requester about the extension and the reasons for it within the first month. Whether a particular request qualifies is a fact-specific judgement — if in doubt, escalate before extending. See Clarification, extensions, refusal, and specialist advice.

This is operational guidance for UK organisations, not legal advice.

When to escalate

Some assessment questions are legal judgements this guidance cannot make for you. Escalate to your organisation's data protection officer or legal adviser — recording the facts and your provisional view on the case first — when you are considering:

treating a request as manifestly unfounded or excessive, charging a fee, or refusing to act;
applying an exemption to some or all of the information;
any situation where the requester disputes your reading of their request.

Record the outcome and its reasons on the case whatever is decided. See Clarification, extensions, refusal, and specialist advice, or Contact product support for product questions.

Official sources

What happens next

Continue to Verify identity or representative authority — identity and authority checks can affect when the response period starts.