Answering a subject access request from a spreadsheet: a step-by-step guide
A subject access request (SAR) asks you to tell someone what personal data you hold about them. If you keep records in Google Sheets™, the answer includes what is in those sheets. This is a practical guide to the spreadsheet part. It is not legal advice; the ICO's guidance is the authority on what you must provide and when.
1. Log the request
Record when it arrived, who is handling it and how you confirmed the requester's identity. The ICO's website explains the time limit. Check it there rather than relying on a figure in a blog post, including this one.
2. List the spreadsheets that might hold the person
Start with sign-up sheets, staff lists, rotas, membership lists, complaints logs and anything exported from another system.
3. Search every place in each file
Use Ctrl+H (find and replace) with Search: All sheets, and look for name variants, email addresses and phone numbers. Then look where search does not reach well:
- Hidden tabs, rows and columns. Unhide them first.
- Cell notes. Find and replace does not search notes.
- Imported data. An IMPORTRANGE can show another file's rows here.
- Dropdown lists. Lists can hold names.
4. Decide what you can disclose
Rows often include other people. Remove or mask other people's data before anything goes out.
5. Send a safe extract, not the original
Make a copy, keep only the requester's rows, delete the rest and any hidden tabs, then check the copy. Share the copy or export it, not the working file with its version history.
6. Keep a record
Write down what you searched and what you sent.
Check before you share
Personal Data and Sharing Check™ scans a Google Sheets™ file for personal data, including hidden tabs, notes and disguised text, and shows who can already see it. It shows masked samples only, never the full value. Checking is free, and your data stays in your browser.
Install from the Google Workspace Marketplace™
Google, Google Sheets™ and Google Workspace™ are trademarks of Google LLC. App Garden™ is not affiliated with or endorsed by Google. This is data-minimisation and sharing-hygiene guidance, not legal advice.
Google, Google Sheets™ and Google Workspace™ are trademarks of Google LLC. Personal Data and Sharing Check is not affiliated with or endorsed by Google.