A customer might message, “Can you send me everything you have about me?” without calling it a subject access request. The ICO says a request can be made verbally or in writing, including through social media, so the wording and channel may be informal.

The ICO updated its subject-access guidance on 16 July 2026 to reflect the Data (Use and Access) Act 2025. Check the live guidance when a request arrives; procedures and legal requirements can change.

Recognise and log the request

Record the date, channel, person making the request and what they are asking for. Do not ignore a request because it arrived in a WhatsApp conversation or because the customer did not use a formal template.

If you have reasonable doubts about the person's identity, the ICO says you may need to verify who they are before sharing information. Ask only for evidence that is proportionate to the risk; do not collect extra documents as a routine obstacle.

Search the places you use

A small trade business may hold personal information in more than one place:

  • Quote, invoice and job-management software.
  • Email, WhatsApp and social-message inboxes.
  • Customer-service notes, call logs and spreadsheets.
  • Job photos, attachments and cloud folders.
  • Paper notebooks or printed work sheets.

Make a reasonable and proportionate search. Keep unrelated customers' information private, and review whether any exemption applies before disclosing information about another person.

Track the deadline and send securely

The ICO says you must respond without undue delay and within one month in most circumstances. A complex request or several requests from the same person may permit up to two extra months, but you should explain an extension within the initial timeframe. In most cases you cannot charge a fee.

Provide the information in a clear, accessible and secure way. Keep a copy of what you sent and when. If the request is unusually broad or sensitive, use the ICO's detailed guidance or seek professional advice rather than guessing.

See the ICO's guide to subject access. For everyday data handling, see our customer enquiry retention guide. This article is general information, not legal advice.