Sar template: Sar Statutory Rules
The Sar Statutory Rules carries 2 published figures read from 2 sources' own pages, from 14 to 40 day, read 24 October 2026.
3 of the 24 named sources read in full publish a figure; 21 publish none, read 24 October 2026.
Every figure, with its source
One row per published figure: the figure as the source's own page publishes it, the page, and the day it was read. A figure that is not on a page we read is not on this one.
| Source | Figure | Read |
|---|---|---|
| Data Protection Act 2018 Schedule 2 (exemptions) | 40day | 2026-10-24 |
| ICO: a guide to the data protection exemptions | 14day | 2026-10-24 |
| Data Protection Act 2018 Schedule 2 (exemptions) | 5month | 2026-10-24 |
| ICO: a guide to subject access | 2month | 2026-10-24 |
| ICO: a guide to subject access | 1month | 2026-10-24 |
| ICO: a guide to subject access | 1month | 2026-10-24 |
The sentence each figure was read from (6)
- Data Protection Act 2018 Schedule 2 (exemptions), read 2026-10-24:
if earlier, before the end of the period of 40 days beginning with the announcement of the results.
- ICO: a guide to the data protection exemptions, read 2026-10-24:
If there is a question as to whether you need to comply with a subject access request in this situation, you must inform the Principal Reporter within 14 days of the question arising.
- Data Protection Act 2018 Schedule 2 (exemptions), read 2026-10-24:
before the end of the period of 5 months beginning when the question arises, or if earlier, before the end of the period of 40 days beginning with the announcement of the results.
- ICO: a guide to subject access, read 2026-10-24:
You may extend the time limit by up to a further two months where necessary, if the request is complex or you receive a number of requests from the person.
- ICO: a guide to subject access, read 2026-10-24:
In most circumstances, you cannot charge a fee to deal with a request. You must respond without undue delay, and within one month of receipt of the request.
- ICO: a guide to subject access, read 2026-10-24:
If you do extend the time limit, you must let the person know and explain why within one month of receiving the request.
Read in full, publishes no figure
21 named sources were read in full on the dates shown and print no usable figure. They are counted, never filled in.
- Access to Health Records Act 1990, read 2026-10-24: read in full and no accepted figure on the page
- Data (Use and Access) Act 2025, read 2026-10-03: read in full and no accepted figure on the page
- DPA 2018 s.167 (compliance orders), read 2026-10-24: read in full and no accepted figure on the page
- DPA 2018 s.45 (right of access, law enforcement processing), read 2026-10-24: read in full and no accepted figure on the page
- DPA 2018 s.45 as enacted, read 2026-09-12: read in full and no accepted figure on the page
- DPA 2018 Schedule 3 part 2, serious-harm exemption (health data), read 2026-10-24: read in full and no accepted figure on the page
- DSIT factsheet: Data (Use and Access) Act 2025, UK GDPR and DPA, read 2026-09-12: read in full and no accepted figure on the page
- EDPB Guidelines 01/2022 on the right of access, read 2026-10-24: read in full and no accepted figure on the page
- GOV.UK published subject access request procedure, read 2026-09-12: read in full and no accepted figure on the page
- GOV.UK: data protection, your rights, read 2026-09-12: read in full and no accepted figure on the page
- GOV.UK: get a copy of your police records, read 2026-09-12: read in full and no accepted figure on the page
- ICO right of access guidance, read 2026-10-24: read in full and no accepted figure on the page
- ICO: can the right of access be enforced?, read 2026-10-17: read in full and no accepted figure on the page
- ICO: how do we recognise a subject access request?, read 2026-10-24: read in full and no accepted figure on the page
- ICO: make a subject access request (public), read 2026-10-17: read in full and no accepted figure on the page
- ICO: subject access Q&As for employers, read 2026-10-24: every candidate on the page was refused
- UK GDPR Article 12 (transparency, time limits and fees), read 2026-10-03: read in full and no accepted figure on the page
- UK GDPR Article 15 (right of access), legislation.gov.uk, read 2026-10-03: read in full and no accepted figure on the page
- NHS England: subject access requests, read 2026-09-26: read in full and no accepted figure on the page
- ICO right of access guidance (PDF, versioned), read 2026-09-12: read in full and no accepted figure on the page
- the authority per rule, read 2026-10-31: read in full and no accepted figure on the page
Methodology
Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2).
3 of the 24 named sources that could be read published a usable figure; 21 published none and are recorded as not published, never filled in; 0 could not be read (blocked, dead or unreachable) and count nowhere.
The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source in day (a source's median where its page yielded several accepted sentences), so N counts sources, never sentences; 13 candidate sentence(s) were refused by a reviewer with the reason recorded.
The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per rule per regime (UK GDPR as it has effect, DPA 2018 with the Data (Use and Access) Act 2025 amendments, the law-enforcement regime in Part 3, the health-records route, and the EU regime for an EEA controller): the obligation, the number in it (one month, two further months, zero fee), the section it comes from and the date it took effect - and, across them, the two things nobody publishes as a table: which of the twenty-odd exemptions actually reach Article 15 and which do not, and what CHANGED at each amendment, so a requester whose refusal cites an old rule can see it
13 candidate sentences on these pages were refused by a reviewer; each refusal and its reason is recorded in the review ledger.
Sources (24)
- Access to Health Records Act 1990(the publisher's own terms; quoted for reporting and comment)
- Data (Use and Access) Act 2025(the publisher's own terms; quoted for reporting and comment)
- Data Protection Act 2018 Schedule 2 (exemptions)(the publisher's own terms; quoted for reporting and comment)
- DPA 2018 s.167 (compliance orders)(the publisher's own terms; quoted for reporting and comment)
- DPA 2018 s.45 (right of access, law enforcement processing)(the publisher's own terms; quoted for reporting and comment)
- DPA 2018 s.45 as enacted(the publisher's own terms; quoted for reporting and comment)
- DPA 2018 Schedule 3 part 2, serious-harm exemption (health data)(the publisher's own terms; quoted for reporting and comment)
- DSIT factsheet: Data (Use and Access) Act 2025, UK GDPR and DPA(the publisher's own terms; quoted for reporting and comment)
- EDPB Guidelines 01/2022 on the right of access(the publisher's own terms; quoted for reporting and comment)
- GOV.UK published subject access request procedure(the publisher's own terms; quoted for reporting and comment)
- GOV.UK: data protection, your rights(the publisher's own terms; quoted for reporting and comment)
- GOV.UK: get a copy of your police records(the publisher's own terms; quoted for reporting and comment)
- ICO right of access guidance(the publisher's own terms; quoted for reporting and comment)
- ICO: a guide to subject access(the publisher's own terms; quoted for reporting and comment)
- ICO: a guide to the data protection exemptions(the publisher's own terms; quoted for reporting and comment)
- ICO: can the right of access be enforced?(the publisher's own terms; quoted for reporting and comment)
- ICO: how do we recognise a subject access request?(the publisher's own terms; quoted for reporting and comment)
- ICO: make a subject access request (public)(the publisher's own terms; quoted for reporting and comment)
- ICO: subject access Q&As for employers(the publisher's own terms; quoted for reporting and comment)
- UK GDPR Article 12 (transparency, time limits and fees)(the publisher's own terms; quoted for reporting and comment)
- UK GDPR Article 15 (right of access), legislation.gov.uk(the publisher's own terms; quoted for reporting and comment)
- NHS England: subject access requests(the publisher's own terms; quoted for reporting and comment)
- ICO right of access guidance (PDF, versioned)(the publisher's own terms; quoted for reporting and comment)
- the authority per rule(the publisher's own terms; quoted for reporting and comment)
Cite or embed this figure
The Sar Statutory Rules carries 2 published figures read from 2 sources' own pages, from 14 to 40 day, read 24 October 2026.
3 of the 24 named sources read in full publish a figure; 21 publish none, read 24 October 2026.
Cite as: "sarbuilder.co.uk Sar Statutory Rules", updated 2026-10-31, https://sarbuilder.co.uk/datasets/sar-statutory-rules/.
Download the CSV (6 rows, computed 2026-10-31)
Questions this data answers
What must a subject access request contain, what must the organisation do, by when, for what fee, and what may it lawfully withhold?
The Sar Statutory Rules carries 2 published figures read from 2 sources' own pages, from 14 to 40 day, read 24 October 2026.
Where do the figures in the Sar Statutory Rules come from?
Every figure is quoted from its source's own page and dated (last read 24 Oct 2026). 24 named sources were read and 3 publish a figure; the 21 that publish none are recorded as not published, never estimated.