Skip to main content
Hafan

What can we consider when responding to a part 3 request?

Contents

In detail

How long do we have to comply?

You must comply with a part 3 SAR without undue delay and at the latest within one month of receiving the request or within one month of receiving:

  • any information you requested to confirm the identity of the person the information is about;
  • any information you requested to confirm that a third party is authorised to act on behalf of the person; or
  • a fee (only in certain circumstances).

How do we calculate a month?

To calculate a month, you must start from the actual date you receive the request, fee or other requested information. Then, count forward to the end of the same date in the following month. Even if you receive the request on a non-working day, you must start from this date.

Example

A request is received on 1 January (a bank holiday), so the one-month period ends at the end of 1 February.

If the date for responding falls on a weekend or is a public holiday, the deadline moves to the end of the next working day.

Example

A request is received on Monday 25 November. The time to respond will run until the end of Friday 27 December. This is because 25 and 26 December are both bank holidays.

If the same date doesn't exist in the following month (because it's shorter), use the last day of that month instead.

Example

A request received on 31 January will run until the end of 28 February (or 29 February in a leap year). If that date falls on a weekend, the deadline is the end of the next Monday.

This means that the exact number of days you have to comply with a request varies, depending on the month in which you receive the request.

If you need to specify a consistent number of days (eg for operational or system purposes), you could adopt a 28-day period. This ensures that you always comply within a calendar month.

Can we extend the time for a response?

Yes. You can extend the time to respond by up to a further two months where necessary, if:

  • the request is complex; or
  • you have received a number of requests from the same person. This can include other types of requests relating to their rights (eg if a person has made a SAR and a request for erasure at the same time).

You must calculate the extension from the original start date – the day you receive the request, fee or other requested information (eg ID or evidence of appropriate authority).

Example

A prosecutor receives a request on 9 June. The response is due on 9 July. However, as the request is complex, the prosecutor extends the time to respond by two months.

The prosecutor has until 9 September to comply with the request. If 9 September falls on a weekend or is a public holiday, the prosecutor has until the end of the next working day to comply.

If you extend the time limit, you must let the person know within one month of receiving their request and explain why.

When is a part 3 request complex?

You should consider your specific circumstances and the particular request when deciding whether a request is complex. What may be complex for one organisation may not be for another. For example, the size and resources of an organisation are likely to be relevant factors.

You must be able to demonstrate why the request is complex in the particular circumstances. The following are examples of factors that may, in some circumstances, add to the complexity of a request:

  • You receive a SAR that relates to information you process under both part 3 and UK GDPR. Therefore, you have to search for information under both regimes to respond.
  • You have to consult with another organisation and seek their views before disclosure.
  • You experience technical difficulties retrieving the information (eg if you store information in an electronic archive).
  • You apply one or more restrictions that involve large volumes of particularly sensitive information.
  • You need to do any specialist work to obtain the information or communicate it in an intelligible form.
  • You have to clarify potential confidentiality issues around disclosing of part 3 information.
  • You need to obtain specialist legal advice (however, if you routinely obtain legal advice, it's unlikely to be complex).
  • You have to search large volumes of unstructured manual records (only applicable to public authorities).

If a person requests a large volume of information, this may add to the complexity of a request. However, a request is not complex solely because it involves a large amount of information.

A request is not complex just because you have to:

  • rely on a processor to provide the information you need to respond; or
  • consult with the processor while you deal with the request.

If you are dealing with UK GDPR information, refer to the guidance on complex requests for SARs in the UK GDPR right of access guidance.

Can we clarify the request in part 3?

Yes. You can ask for further information to help you to identify the personal information or the processing activity that the SAR relates to.

However, you should only ask for clarification if it's reasonably required. You should not ask for it on a blanket basis.

The legislation does not define what 'reasonably required' means. However, it's likely to mean that, until you have received clarification, you cannot provide an effective response to the SAR. For example, this may be the case if the request is vague or you hold a lot of information about the person or both.

If you do ask for clarification, the time limit is paused on the day you request clarification and resumes on the day after you receive it. This is referred to as 'stopping the clock'.

This means that you do not need to provide the person with a copy of the information until they have clarified their request. This includes any supplementary information that you cannot reasonably provide.

You are not required to seek clarification, and you could choose to perform a reasonable and proportionate search instead. (See What efforts do we need to make to find information?.)

What do we need to think about if we ask for clarification?

Given the importance of the right of access, you should be able to justify why it's reasonable for you to ask for clarification before you can identify the information requested.

For example, it may be reasonable for you to ask for clarification if:

  • you hold a large amount of information about the person; or
  • the request is unclear.

You are responsible for justifying that you will need to search through a large amount of information to deal with a SAR. It's unlikely to be reasonable or necessary to ask for clarification if you can locate, retrieve and provide information about the person quickly and easily – even if you hold a large amount of information about them.

Whether you hold a large amount of information about a person depends, to an extent, on your organisation's size and available resources:

  • A big organisation may not consider a request to be high volume if it has significant resources for performing searches.
  • A smaller organisation with fewer and less sophisticated resources at its disposal may be more able to argue that it holds a large amount of information.

Another factor to consider is whether, because of the volume of information you hold, you are unlikely to be able to locate and retrieve all the requested information by performing a reasonable search.

If you need clarification, you can ask the requester to provide additional detail about their request. This may include the context in which you are likely to hold their information and the relevant dates.

However, you cannot force a person to narrow the scope of their request, as they are entitled to ask for all of their information. If a person responds to you and either repeats their request or refuses to provide any additional information, you should still comply with their request by making reasonable searches.

Example

An employee of the Land Registry (the requester) makes a SAR for "all the information you hold about me concerning disputes or investigations".

The Land Registry processes a large volume of information about the requester, as they were involved in various disputes and investigations, some of which are still ongoing. In particular, the Land Registry holds information about the following matters:

  • A property dispute between the requester and their next-door neighbour several years ago.
  • A grievance between the requester and another employee.
  • Numerous disciplinary matters concerning the requester's behaviour at work and their attendance.
  • A complaint made by the requester to the Land Registry about its handling of their freedom of information request.
  • The requester is currently buying a house, and the Land Registry is investigating allegations of fraudulent activity on the part of the vendor. The fraud investigation is being dealt with under part 3. The file contains personal information about the requester and various complaints from the requester about the handling of the case.

The Land Registry processes a large volume of information about the requester, including a mixture of UK GDPR and part 3 information. Therefore, it considers it reasonably necessary to seek clarification as it's not clear what information the person wants. It decides to stop the clock to ask the person to specify what information they are looking for.

Example

A person makes a SAR to the police for "any information you hold about me that I might need to get legal advice about".

The police hold the following information about the person under part 3:

  • They are a repeat offender with a large number of convictions.
  • They were subject to physical abuse as a child by carers.
  • They were a witness to a high profile crime and are at risk.

As the police hold a high volume of information about the person across different categories, it is not clear what information they are looking for. The police cannot decide whether the person needs to obtain legal advice, so the wording of this SAR makes it difficult for them to respond.

In the circumstances, the police take the view that they reasonably require clarification from the person to be able to respond to their SAR. The police ask the person to explain:

  • what information they want them to look for; and
  • whether they want them to search their records in relation to a particular incident or between particular dates.

However, the police explain that they cannot comment on whether or not the person needs to get legal advice.

If you can reasonably provide any of the supplementary information without clarification, you must provide it within one month. If your privacy notice already contains this supplementary information, you could provide the person with a link to it.

Even if you're seeking clarification, you may still be able to provide some information, although this will depend on the circumstances.

For example, in many cases you can confirm that you hold information about the person. In addition, it's likely that you can provide some of the supplementary information, including details of their right to:

  • request rectification, erasure or restriction, or to object to processing;
  • complain to the controller; and
  • make a complaint to the ICO.

Example

A member of police staff makes a SAR to the police for “the information you hold about me in relation to an ongoing dispute”. This member of staff is currently subject to disciplinary action and is also being investigated about their suspected involvement in a separate criminal matter. There is also some information on their HR record that could be regarded as relating to an ongoing dispute.

As the person is an employee, the police hold a lot of information about them. The police don’t think it is clear from the SAR what information the person is seeking. In these circumstances, the police decide they reasonably require the person to clarify what information they want before they can respond.

Once they’ve asked for clarification, the police can ‘stop the clock’. They are not required to provide a response until the person responds to the request for clarification. However, the police can still provide some of the supplementary information, including the: 

  • purposes of processing;
  • categories of personal information;
  • retention period; and
  • person’s right to make a complaint to them and to the ICO, within one month. 

The police send the person a copy of their privacy information (which already contains these details) when they ask for clarification.

You should ensure the process of seeking and obtaining clarification is quick and easy for the requester. When asking for clarification, you should:

  • provide advice and assistance to help them clarify their request;
  • explain that the clock stops from the date that you request clarification and will resume the day after they respond; and
  • specify if they need to reply by a certain time.

Where possible, you should contact the person in the same format that they made the request. For example, if they have emailed the SAR, you should email them to ask for clarification.

If you receive a request where it's genuinely unclear whether a person is making a SAR, the time limit does not begin until you have clarified:

  • whether the person is making a SAR; and
  • what personal information they are requesting.

You should contact the person as soon as possible (eg by phone or email where this is appropriate). If you talk to the person, you should keep a record of:

  • any conversation with them about the scope of their request; and
  • the date(s) that you requested and received any further explanation.

In all circumstances, you should explain to the person why you are seeking further details and, if asked, be able to justify your position to the ICO.

When you ask for clarification, the timescale for responding stops until the person clarifies their request. It then resumes the day after you receive that clarification. You should calculate the timescale as follows:

  • When you receive a request, calculate when the response would normally be due. (See How long do we have to comply?.)
  • If you have requested clarification, you may extend this time limit by the number of days that you stopped the clock.

Example

If you receive a request on 14 May, the time limit starts on the same day. You have one month to reply, which means the response is due by or on 14 June.

However, if you ask for clarification on 15 May, the clock stops from 15 May until the requester responds. If the requester provides you with clarification on 18 May, the timing resumes on 19 May.

The clock was stopped from 15 May until 18 May. This means that you can extend the original one-month deadline by four days, and your response is due by or on 18 June.

You should request clarification as soon as possible after receiving the request. This will enable you to search for the information the person wants at the earliest possible stage and give you more time to respond.

Example

An organisation receives a request on 19 June. As the equivalent date in July falls on a Sunday, the organisation has until Monday 20 July to comply.

The organisation waits until 15 July to ask for clarification. The person responds on 16 July, which means that the original deadline can be extended by two days. The response is due by Wednesday 22 July.

However, the organisation can't comply with the deadline as it did not leave enough time to search for the information after obtaining clarification.

It may only become apparent after starting a search that you need further information to respond to the SAR. If so, you should be able to explain why you were unable to ask for clarification earlier. You should record your reasons.

If you ask for clarification and receive it on the same day, the clock stops for one day only. You should calculate any extension to the time limit in terms of days, not hours.

Example

If you receive a SAR on 1 July, request clarification on 2 July at 9.00am, and receive clarification later that day (up to 11.59pm), you can extend the time limit by one day. The response is due on 2 August.

The clock only stops if you are seeking clarification about the information requested. It does not apply if you ask for clarification on any other matter (eg the format of the response).

Example

A person requests a copy of their information from the Prison Service from 5 February 2015 until 9 August 2021. They specifically ask the organisation to forward the information by email. However, because of security concerns, the Prison Service cannot do this. Instead, it can provide the person with remote access to their information. It asks the person whether they are happy with this, and checks that they can access the records.

The clock does not stop when the Prison Service asks for clarification, and the usual time limit of one month still applies. Since the time limit is not paused while waiting for a response, the Prison Service should:

  • begin searching for the requested information as soon as possible; and
  • respond without undue delay.

If you seek clarification but do not receive a response, you should wait for a reasonable period of time before considering the request closed. One month is generally reasonable, but you should use a proportionate and reasoned approach. If you believe that a person might find it difficult to provide additional details within a specified timeframe, you should try to accommodate them as much as possible. For example, this may apply when there are complex issues or accessibility considerations.

If you need to request both clarification and proof of ID, you should request both as soon as possible. It's unreasonable to wait until the person provides clarification before asking for ID documents, unless there is a risk of disclosing personal information to the person before you have checked their identity.

You can extend the time limit by two months if the request is complex or the person has made a number of requests (see Can we extend the time for a response?). However, a request is not complex just because you need to seek clarification. (See the earlier section When is a part 3 request complex?.)

Can we charge a fee under part 3?

In most cases, you must provide the information free of charge.

However, if a request is manifestly unfounded or excessive, you could charge a reasonable fee for the administrative costs of complying with it, rather than refusing to comply. You could also charge a reasonable administrative fee for providing further copies of your SAR response. (See When can we consider a part 3 request to be manifestly unfounded or excessive? for more information.)

Further reading – ICO guidance

What is personal data?

Guide to law enforcement: