Last updated: 3 October 2026
Short answer: use Microsoft Purview eDiscovery to search mailboxes, OneDrive, SharePoint and Teams for the person’s data, export the results, then review and redact before you reply. Under UK GDPR you normally have one month from receipt to respond.
What is a subject access request?
A subject access request (SAR) is when someone, often a current or former employee or a customer, asks for a copy of the personal data you hold about them. It is a right under UK GDPR, and the clock starts when you receive the request, not when you find it.
How do we run a SAR in Microsoft Purview?
- Log the request and confirm identityRecord the date received, work out the deadline and check the requester is who they say they are.
- Create an eDiscovery caseIn the Microsoft Purview portal, open eDiscovery and create a case for the request so everything is tracked in one place.
- Build the searchUse the person’s name, email addresses, aliases and any employee or customer reference, plus a date range if it helps narrow results.
- Choose the locationsAdd their mailbox, OneDrive, the SharePoint sites they work in and Teams chats and channels.
- Run and check the resultsReview the statistics and sample items to make sure the search is neither too narrow nor sweeping up unrelated data.
- Export the resultsExport the items so they can be reviewed outside the search tool.
- Review and redactRemove other people’s personal data and anything exempt before disclosure, and note what you withheld and why.
- Send securely and keep a recordSend the response within the deadline using a secure method, and keep a note of what was searched and sent.
What does the ICO expect?
| Question | Short answer |
|---|---|
| How long do we have? | One month from receiving the request, with up to two further months if it is complex or you have received several requests from the same person. |
| Can we charge? | Normally no. A reasonable fee is only allowed in limited cases, such as repeated or manifestly unfounded requests. |
| How hard must we search? | A reasonable and proportionate search of the places the data is likely to be held. |
| What about other people’s data? | You need to consider whether it is reasonable to disclose it, and redact where it is not. |
| Can we refuse? | Only where an exemption applies or the request is manifestly unfounded or excessive. Record your reasons. |
Where do businesses get stuck?
| Problem | How to avoid it |
|---|---|
| Not knowing where to start | Follow a repeatable process, with one named owner and a case file for each request. |
| Searches that return thousands of items | Tighten keywords, add date ranges and test on a sample before exporting. |
| Data in places nobody checked | Map where staff and customer data lives, including shared mailboxes and Teams channels. |
| Missing the deadline | Start the same day, and set reminders at one week and two weeks. |
| Disclosing other people’s data | Review every item and redact before it leaves the building. |
Can ABCOM run a SAR for us?
Yes. We have helped several organisations run subject access requests in Microsoft Purview, preparing and organising the files so clients know exactly where to start and what to send. Compliance is one of our services, and we can set up the process in advance so the next request is routine. See our cyber security and compliance services or book a free IT review.
Sources and further reading
Want this looked after for you?
ABCOM has supported Sussex businesses and charities since 1996 and is an NCSC Assured Service Provider – Cyber Advisor (Cyber Essentials). Talk to a real person about your IT.
Also read
How ABCOM can help
Talk to a real person at our Burgess Hill office. We are an NCSC Assured Service Provider and have supported Sussex businesses since 1996.