It rarely looks like a request
Under UK data protection guidance, a request for a copy of a person's own data needs no special wording and can arrive by any channel, including social media. In a support inbox it looks like "send me everything you hold on me"; "delete my account and my data" is a related erasure request to pass to the same person. The ICO says the response is due within one month, that it can be extended by up to two more months for a complex request (your handler decides), and that staff should be trained to recognise one.
What to put in place
Write down who handles requests, where a message that might be one should go and how the received date is recorded. Give support staff a one-page card with example phrases. If you serve customers in other places, ask your adviser for those deadlines; this guide covers the UK only and is not legal advice.
- A named person for requests.
- A card of example phrases for support staff.
- The received date and due date written on every candidate message.
Where a paid check fits
The paid job spots messages that may be requests, stamps the received date and a due date you state, and alerts a named person. It does not answer or fulfil requests and does not replace training your staff.
Sources and limits
- ICO: a guide to subject access Checked 2026-10-12.
- A subject access request needs no special form of words and can be made verbally or in writing, including through social media.
- The response is due within one month, extendable by up to two further months for a complex request, and staff should be trained to recognise a request.