GDPR SAR Response Pack

Four ready-to-copy letters for responding to Subject Access Requests as a UK journalist — including the journalism exemption under UK GDPR Schedule 2 Part 5 Paragraph 26, the Section 14 refusal, and partial disclosure with redactions.

Last reviewed: 13 June 2026Next review due: 13 December 2026

Note: This is a template — adapt it to your specific situation. Not legal advice. For complex GDPR situations, consult a solicitor or the ICO. The journalism exemption must be assessed on a case-by-case basis and is not a blanket shield against all SARs.

Who this pack is for

This pack is for UK journalists and news organisations that receive Subject Access Requests from individuals who feature in — or are the subject of — their reporting. SARs are increasingly used by subjects of investigations to probe what notes, emails, and sources a journalist holds. Responding correctly is both a legal obligation and a matter of editorial self-defence.

The templates cover the four most common responses: a straightforward acknowledgement (starting the one-month clock), a Section 14 refusal for vexatious or repetitive requests, a journalism-exemption claim letter where disclosure would prejudice reporting, and a partial disclosure letter where some data is released and some is withheld. Contact the ICO for complex or disputed cases: ico.org.uk.

Exemption decision flowchart (prose)

Step 1. Is the data requested processed for the special purposes of journalism? If no — the journalism exemption does not apply; respond in full unless another exemption applies.
Step 2. Do you reasonably believe that complying with the SAR would be incompatible with the journalistic purpose? If no — respond in full or partially.
Step 3. Would compliance be likely to prejudice that journalistic purpose (e.g. by identifying a confidential source, revealing unpublished material, or undermining an ongoing investigation)? If no — respond in full or partially.
Step 4. All three conditions are met — you may apply the journalism exemption. Document your reasoning now, before sending your refusal letter.
Step 5. Is any part of the data not covered by the exemption? If yes — provide partial disclosure of that data using Template 4.
Step 6. Is the request manifestly unfounded or repetitive? If yes — consider a Section 14 refusal (Template 2) instead of, or in addition to, the exemption.

What’s in this pack

Four templates — copy, adapt, and send.

Initial Acknowledgement

Starts the one-month clock and confirms receipt of the SAR.

Section 14 Refusal

Refuses manifestly unfounded or excessive requests under UK GDPR Article 12(5).

Journalism Exemption Letter

Applies the DPA 2018 Schedule 2 Part 5 Para 26 exemption with documented reasoning.

Partial Disclosure Letter

Releases some data and withholds the rest, with reasons for each category.

Template 1: Initial Acknowledgement

Send this within a few days of receiving a SAR to confirm receipt and start the one-month clock clearly.

SUBJECT ACCESS REQUEST — ACKNOWLEDGEMENT

Date: [DATE]
To: [DATA SUBJECT NAME]
Address: [ADDRESS]
Your reference (if any): [REFERENCE]

Dear [DATA SUBJECT NAME],

Thank you for your Subject Access Request received on [DATE OF REQUEST].

We are writing to acknowledge receipt. Under Article 12 of the UK General Data Protection Regulation (UK GDPR), we are required to respond to your request within one calendar month of receipt, i.e. by [DATE ONE MONTH FROM RECEIPT].

If we need additional information to locate your data, or if your request is complex, we may extend this deadline by a further two months. If so, we will notify you within the first month.

We will write to you again once we have completed our review of the data we hold.

If you have any questions in the meantime, please contact us at [EMAIL / ADDRESS].

Yours sincerely,
[YOUR NAME]
[ORGANISATION / PUBLICATION]
[EMAIL] | [PHONE]

ICO registration number (if applicable): [NUMBER]

Template 2: Section 14 Refusal (Manifestly Unfounded / Excessive)

Use where the request is clearly vexatious or is the latest in a series of repetitive requests. Document your reasoning before sending.

SUBJECT ACCESS REQUEST — SECTION 14 REFUSAL LETTER

Date: [DATE]
To: [DATA SUBJECT NAME]
Your request date: [DATE OF REQUEST]

Dear [DATA SUBJECT NAME],

We are writing in response to your Subject Access Request received on [DATE].

Having carefully considered your request, we are refusing to comply on the following grounds:

[Select applicable ground and delete the other]

MANIFESTLY UNFOUNDED
We consider this request to be manifestly unfounded under Article 12(5) of the UK GDPR because: [EXPLAIN — e.g. the request appears designed to identify the source of a story rather than exercise a genuine right of access; the data subject has indicated in correspondence that the purpose of the request is [OTHER PURPOSE]].

EXCESSIVE (REPETITIVE)
We consider this request to be excessive under Article 12(5) of the UK GDPR because: [EXPLAIN — e.g. this is the [NUMBER] request you have made within [PERIOD] covering substantially the same data].

Your right to complain: You have the right to complain to the Information Commissioner's Office (ICO):
— Online: ico.org.uk/make-a-complaint
— Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
— Phone: 0303 123 1113

You also have the right to seek a judicial remedy under Article 79 of the UK GDPR.

Yours sincerely,
[YOUR NAME]
[ORGANISATION / PUBLICATION]

Template 3: Journalism Exemption Claim Letter

Use where all three conditions for the DPA 2018 Schedule 2 Part 5 Para 26 exemption are met. Always document your reasoning before sending and keep a copy on file.

SUBJECT ACCESS REQUEST — JOURNALISM EXEMPTION LETTER

Date: [DATE]
To: [DATA SUBJECT NAME]
Your request date: [DATE OF REQUEST]

Dear [DATA SUBJECT NAME],

Thank you for your Subject Access Request received on [DATE], in which you requested access to personal data we hold about you.

We have reviewed your request carefully. We are applying the journalism exemption under the Data Protection Act 2018, Schedule 2, Part 5, Paragraph 26 (implementing UK GDPR Article 85), and are therefore not providing access to the requested data.

Reason for applying the exemption:
The personal data you have requested is processed for the special purpose of journalism. We reasonably believe that compliance with your request would be incompatible with that journalistic purpose because: [EXPLAIN — e.g. complying would require us to reveal unpublished investigation material; disclosing our notes or sources would prejudice our ongoing investigation; the data requested forms part of our editorial decision-making process which, if disclosed, could identify a confidential source].

We are satisfied that the three conditions for the exemption are met:
(a) The processing is for the special purposes of journalism.
(b) We reasonably believe that compliance with your request is incompatible with those purposes.
(c) Compliance would be likely to prejudice those purposes.

Your right to complain: If you are dissatisfied with this decision, you may complain to the Information Commissioner's Office:
— Online: ico.org.uk/make-a-complaint
— Phone: 0303 123 1113
— Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We have documented our decision-making process as required by the UK GDPR accountability principle.

Yours sincerely,
[YOUR NAME]
[ORGANISATION / PUBLICATION]

Template 4: Partial Disclosure with Redactions

Use where some data can be released but other data is protected. List each category and the reason for withholding it.

SUBJECT ACCESS REQUEST — PARTIAL DISCLOSURE LETTER

Date: [DATE]
To: [DATA SUBJECT NAME]
Your request date: [DATE OF REQUEST]

Dear [DATA SUBJECT NAME],

Thank you for your Subject Access Request received on [DATE].

We have completed our review and are providing partial disclosure of the personal data we hold about you.

DATA WE ARE DISCLOSING
[DESCRIBE OR ATTACH the categories of data being provided, e.g. your name and contact details as held in our editorial correspondence records]

DATA WE ARE WITHHOLDING (WITH REASONS)
[CATEGORY OF DATA] — withheld because: [REASON, e.g. this data is subject to the journalism exemption under DPA 2018 Schedule 2 Part 5 Para 26; disclosing it would identify a confidential source]

[CATEGORY OF DATA] — withheld because: [REASON, e.g. this data relates to a third party whose rights override your right of access under UK GDPR Article 15(4)]

[REDACTED DATA] — where we have redacted third-party personal data from documents we are otherwise providing, we have indicated redactions clearly.

Your right to complain: If you are dissatisfied with this partial disclosure, you have the right to complain to the ICO at ico.org.uk/make-a-complaint or 0303 123 1113.

Yours sincerely,
[YOUR NAME]
[ORGANISATION / PUBLICATION]

ICO contact details

Website: ico.org.uk
Helpline: 0303 123 1113 (Mon–Fri, 9am–5pm)
Complaints: ico.org.uk/make-a-complaint
Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Journalism guidance: ico.org.uk — Journalism & Special Purposes Exemptions

Frequently asked questions

Can a journalist receive a Subject Access Request about their reporting?

Yes. Any individual (a data subject) can make a Subject Access Request to any organisation or person who processes personal data about them — including journalists and news organisations, where personal data is processed in connection with journalism. The request triggers a one-month response deadline under UK GDPR Article 12.

What is the journalism exemption under UK GDPR?

The Data Protection Act 2018, Schedule 2, Part 5, Paragraph 26, provides an exemption from most of the data subject rights (including the right of access) where processing is undertaken for the special purposes of journalism, academic, artistic, or literary expression. The exemption applies where: (a) the processing is for the special purposes; (b) the controller reasonably believes that compliance would be incompatible with those purposes; and (c) compliance would be likely to prejudice the processing. The exemption does not apply automatically — you must assess it and document your reasoning.

What counts as "manifestly unfounded or excessive" under Section 14?

Under UK GDPR Article 12(5) (implemented via Section 14 of the Data Protection Act 2018), a request is manifestly unfounded if the data subject clearly has no intention of exercising their right of access and is making the request for another purpose, such as harassment. A request is excessive if it is repetitive. You can refuse or charge a reasonable fee. You must be able to demonstrate why the request meets this threshold — a refusal that does not stand up to ICO scrutiny can lead to enforcement action.

How long do I have to respond to a Subject Access Request?

One calendar month from the date you receive the request, under UK GDPR Article 12(3). You can extend this by a further two months where the request is complex or you have received a large number of requests, but you must inform the data subject within the first month that you are extending the deadline and explain why.

What should I do if I am unsure whether to apply the journalism exemption?

Document your reasoning carefully before reaching a decision. Consider whether disclosing the requested data would identify confidential sources, reveal unpublished investigation material, or otherwise prejudice the journalistic purpose. If you apply the exemption, tell the data subject you are doing so and that they have the right to complain to the ICO. The ICO guidance on journalism and data protection is available at ico.org.uk.