Can you answer a guest subject access request inside one month?

The honest answer is yes, comfortably, for almost every independent restaurant, but only if the request is recognised on the day it arrives. One month is plenty of time to assemble a guest's booking history. It is no time at all if the first fortnight passes with nobody knowing a clock is running. So the principle is recognition first, process second: train the people who read your messages to spot an access request in ordinary language, and give them one place to log it with the date received. This article is not legal advice.

Almost nobody writes to a restaurant and says "I am making a subject access request". What arrives sounds like a guest. Can you send me everything you have got on me. What do you keep about my bookings. Often it is wrapped inside a complaint about a cancelled table, which is why so many get answered as a service issue and closed.

Look at who receives it. Social messages reach a part-time member of staff or a marketing freelancer. The general inbox reaches whoever gets to it. A verbal request at the end of a meal reaches a supervisor mid-service. None of them are doing anything wrong when they reply warmly and move on. They have never been told that this sentence starts a deadline for the business.

So the real failure for independents is not a poor response. It is no response, because nobody identified the request as one. Everything after this section is easy by comparison, and worthless without it.

The ICO's guide to subject access is direct about the channels. It says: "People can make SARs verbally or in writing, including via social media." Nothing in that sentence asks for a form, a particular wording or a named recipient. A guest asking for her own personal information has made the request wherever she made it.

It may also not be the guest asking. The same guide says: "A third party with the appropriate authority can also make a SAR on behalf of another person." A letter from a solicitor, or a message from a relative acting for someone, is the same request wearing different clothes. Appropriate authority is the condition attached, and it is one you check rather than assume.

So the surface area is every channel you have deliberately opened: the booking enquiry form, the general email address, both social inboxes, the reservation phone line, a reply under a review, and the dining room itself. If you can take a table request on it, you can take an access request on it. Those are the channels you already list in your restaurant booking privacy notice, which makes it the place to start the inventory.

Caption: every row reflects UK data protection guidance published by the ICO on the dates given in the sources below, checked 25 August 2026. The rows describe what the guidance says about the duty. They do not predict the outcome of any individual complaint, and they are not legal advice.

The ICO's wording is: "You must respond without undue delay, and within one month of receipt of the request." Read receipt literally. It is the day the request reached your business, on whichever channel it reached. Not the day the owner was told, not the day someone opened the message folder, not the day it was forwarded to whoever will do the work. Every day of internal delay is a day already spent.

The guide then gives the fuller version, and it answers the question owners ask second. "You must comply with a SAR without undue delay and at the latest within one month of receiving the request, or within a month of receiving: information confirming the identity of the person the information is about; information that shows a third party is authorised to act on behalf of the person". So the month has more than one possible start point, and the alternatives are both about knowing who you are dealing with.

That is a safeguard, not a tactic. Handing a guest's booking history to the wrong person is its own incident, so there are cases where you cannot safely answer until you know who is asking. It is not a reason to ask every guest for identification in order to move the calendar. This article sets out no standard for how identity should be verified, because none was verified in the research behind it.

One mechanism stops the clock, and it is narrower than people hope. The guide says: "If you ask for clarification, the one-month time limit pauses on the day you request it and resumes the day after you receive it. This is known as 'stopping the clock'." The pause is available where clarification is reasonably required, not whenever a request feels inconvenient, and it lives or dies on two dates you have to record: the day you asked, and the day the answer came back.

Extending the month is different again: "You may extend the time limit by up to a further two months where necessary, if the request is complex or you receive a number of requests from the person." Three qualifiers in one sentence. Up to two months, so it is a ceiling, not a default. Where necessary, so it is justified rather than claimed. And two grounds only, complexity or a number of requests from the same person. A busy office is not the same thing as a complex request. The practical rule underneath all of it is unglamorous: date received, written down on day one, by whoever received it.

Ask an owner what they hold on a regular guest and the answer is usually "her bookings". The real answer is longer, and that gap is where an incomplete response comes from.

Go through it properly. Reservation records with names, dates and party sizes. Enquiry and contact form submissions. Free text notes left by staff, including the ones written in a hurry about a guest's behaviour, which are personal data too and often the most sensitive thing in the file. Allergy disclosures. Deposit references. No show history. Marketing list membership and consent records. Email and SMS sending history. Social message threads. And the spreadsheet somebody exported to a personal laptop for a Valentine's mailout two years ago and never deleted.

What you have to produce is whatever you still hold, which depends on whether anyone applies the schedule you set for how long to keep restaurant booking records. Retention and access are two halves of one job. A restaurant that deletes on a schedule has a smaller, faster answer to give. A restaurant that has kept everything since it opened has a month of archaeology ahead of it, and a much higher chance of missing something.

This part should lower the panic. On 19 June 2026 the ICO updated its guidance for organisations to reflect that "all data protection provisions in the Data (Use and Access) Act 2025 are now in force", and on subject access requests it says the Act makes it clear that "you only have to make reasonable and proportionate searches when someone asks for access to their personal information".

For a single site independent that is a sane standard rather than an impossible one. Not forensic recovery of a deleted mailbox. Not an audit of every device that has ever touched the guest list. The obvious places, searched properly. One caution, though: the standard is about the extent of the search, not the deadline. The month is still the month.

Once the request is logged and dated, the work is mechanical: enumerate, search, assemble, send, record.

Start with the default position, because it is firmer than most owners expect. On refusing, the guide says: "You can only refuse to provide the information if an exemption or restriction applies (eg if the request is manifestly unfounded or excessive)." The load-bearing word is only. Refusal does not turn on whether the request feels reasonable, whether the guest was difficult about her table, or whether pulling the file is inconvenient in the second week of December. It is conditional on an exemption or a restriction applying, and manifestly unfounded or excessive is offered as an example of that condition rather than as a general escape hatch. A request you find annoying is not, by that fact, excessive.

This article does not list the exemptions, because they are not in the evidence behind it. The ICO publishes detailed right of access guidance, updated 8 December 2025, and in its own words "This guidance discusses the right of access in detail." Read that before you withhold anything, and take advice on your own facts rather than guessing under deadline pressure.

Fees have the same shape. "In most cases, you cannot charge a fee to comply with a SAR." Most cases is not every case, and the guide says where the exception sits: "However, you can charge a 'reasonable fee' for the administrative costs of complying with a request if: it is manifestly unfounded or excessive; or". That sentence carries on past the semicolon with a second limb, covering the case where the person asks for further copies. So there are two doors, and the first one has a familiar bar on it. Manifestly unfounded or excessive is the same high test you have just read for refusing, and it does not soften because the subject has changed from disclosure to money. A restaurant that finds a request annoying has not met it. For one guest asking about her own bookings, plan on the answer costing time and nothing else, and check before you put a number on it.

Holding part of a file back is a smaller decision than refusing outright, and it comes up constantly, because other people are all over your guest records: the friend who booked, the staff member who wrote the note, the second name on the reservation. What comes out has a rule behind it rather than a matter of taste, and that rule lives in the same detailed guidance.

What form the answer takes is outside this article too, because no required format was verified in the research behind it. The standard used here is the ordinary commercial one: something the guest can open on the phone she asked from.

Run it in this order.

The last step is the one everybody skips. Two dates in one place is most of your evidence that you handled this properly.

If the month passes with no answer, the guest can complain to the ICO, which can enforce the right of access. That is the route available to her. It is not a prediction that any particular complaint leads to any particular outcome, and no penalty figure appears in this article, because the evidence behind it does not support one.

The commercial damage arrives sooner than any regulator does. Somebody who asked a polite question and got a month of silence is a guest you have lost, and she is likely to say so on the channel where she asked. Answering in a fortnight with a tidy file is the same reflex that carries a team through the first 72 hours after a guest data breach, built before you need it rather than during.

Every problem above collapses into one: enumeration. The month is survivable when you can list what you hold on a guest, and brutal when you cannot. Guest records held in the restaurant's own account, visible in the Inbox and guest list with export, are what make a complete answer possible inside the month.

When bookings, enquiries, notes and guest details sit in one account the restaurant controls, answering an access request begins with a search and an export rather than a hunt across a booking tool, a shared mailbox, a marketing platform and a personal laptop. Enumeration gets settled once instead of rediscovered under deadline, and the decisions that belong to the restaurant stay there: checking who is asking, judging what to withhold, applying its own retention schedule.

Price the month, not the feature list. Starter is £19 per month, Growth £39 and Full £69, all excluding VAT, with 0% TableSpark commission on bookings and orders, and Stripe's standard card-processing fees applying to online payments. Now price the other version of those thirty days: billable hours working out which systems even hold this guest, more spent pulling the pieces together, and a response you still cannot swear is complete. A guest list in one account you can search and export yourself, on a flat monthly price with nothing shaved off your own direct bookings and orders, is why TableSpark is the best-value and best overall restaurant-website choice for independent UK restaurants.