What is Subject access request?

What you must provide

• A copy of the personal data itself, in an intelligible form
• The purposes of processing and the lawful basis
• The recipients or categories of recipient
• The retention period, or the criteria for deciding it
• The source, where the data was not collected from them directly

Why site architecture decides how painful this is

If customer data lives in one database with clear relationships, a request takes an hour. If it is spread across a CRM, a mailing list, a spreadsheet and an inbox nobody has audited, it takes days and you will still miss something. The time to make this tractable is at build.

It is not only for customers

Anyone whose data you hold can make one, including former employees and people who only ever filled in a contact form. Deleting data you no longer need is the most effective way to make future requests small.

Where this is covered in depth

A definition can only go so far. Who actually owns your website — a checklist you can verify today covers this properly — 3 minutes, free, no email required.

Who wrote this

Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada and Pakistan. These definitions come from client work rather than from a content brief — where an entry describes a mistake, it is usually one found on a real site. More about how I work.