Personal Data Access Requests: Is Your Portal Preparing a Response or Just Exporting a Customer Record?

A request for a copy of someone's personal information needs a reviewed response workflow, not merely a button that downloads their customer profile. Before commissioning a portal, decide how requests reach the responsible team, how searches are recorded and who approves the material actually supplied. A file successfully generated is not evidence that the request has been answered.

This guide uses the UK Information Commissioner's Office's guide to subject access, updated in July 2026. Its legal context is the UK GDPR. It is not a statement of the rules in every country or a complete legal procedure. Have your data protection adviser approve the applicable scope, timing, exceptions and communications. The software requirements below are practical proposals, not a compliance certification.

Let the request arrive outside the portal

The ICO says a person can make a subject access request verbally or in writing, including through social media. No special phrase, legislation reference or particular contact is necessary when it is clear that they are asking for their own personal information.

Your optional portal therefore should not become the only route staff recognise. Provide a way for an authorised employee to record a request received elsewhere, preserving the original wording, channel and receipt time. Do not substitute the later date on which someone creates the case.

For a fictional repair business, a customer might ask during a telephone call for the personal information the business holds about them. Logging that request should start the team's handling process. It should not silently send them back to fill in an online form before anyone takes responsibility.

Identify the person, not just a matching name

Separate the requester, the person whose information is sought and any representative. The ICO says a representative's authority must be established before responding. It also advises reasonable, proportionate identity checks and requesting formal identification only when necessary.

Ask for review states such as identity assessment pending and representative authority confirmed. Do not make a passport upload the universal default. The adviser should define what evidence is appropriate, who can inspect it and how it is handled. A familiar email address or a matching surname should not automatically release a response containing someone else's information.

Children's requests and specialist record types need their own assessment; this ordinary business workflow is not a shortcut around those rules.

Track the search separately from the download

The ICO requires a reasonable and proportionate search. An export of the main customer table does not demonstrate which other relevant systems were considered. Equally, the guidance does not demand searches that are unreasonable or disproportionate to the information's importance.

For your brief, list possible information locations and assign a responsible reviewer to each relevant search task. Record what was searched, the scope and outcome, and an explanation for any location not searched. Distinguish no relevant information found from search not yet performed.

Keep collected working material separate from the proposed response. A search result can contain information about several people or material needing an exemption assessment. The ICO describes case-specific exemption decisions and qualifications around information about others. Do not automatically disclose everything found, or automatically withhold an entire document because another person's name appears. Route that decision to the authorised reviewer rather than encoding a simplistic rule.

Make timing visible without inventing a universal countdown

The ICO describes a one-month response framework, identity and representative-authority conditions, necessary extensions and reasonably required clarification. These are not one interchangeable paused status. In particular, clarification must not be used to force someone to narrow their request.

Have the adviser approve the deadline calculation before development. Preserve receipt, relevant information requests and replies, any approved extension and its required communication. The interface should explain the event behind a changed target date. An internal reassignment or unfinished search must not quietly reset the clock.

Approve the response people will actually receive

The right concerns a copy of personal information and supplementary information, not just account closure or an operational CSV. The ICO says electronic requests normally require a commonly used electronic format unless the person asks otherwise. A secure online platform must allow an accessible download; if the person cannot or does not want to use it, an alternative response method is required.

Specify approval against the exact response package and covering explanation. Record the intended recipient, delivery method and actual sending outcome. A portal invitation alone should not mark the case complete. Secure delivery, accessibility and any refusal communication need their own checks.

Before acceptance, demonstrate an off-portal request, a representative, an unsearched location, a reviewed mixed-person result and a requester needing an alternative format. Use synthetic records. Bring those cases to your business app project discussion so the funded feature is a traceable response process, not an export button labelled as legal compliance.