Could you answer a subject access request in Teams and Slack today?
Ten questions, about three minutes. You get a readiness score, the specific gaps in your answers, and what to do about them. Nothing you choose leaves your browser unless you decide to send us a message.
Updated 12 October 2026
A subject access request covers the person’s data wherever you hold it, including Teams and Slack, and the clock is one month. If capture and retention were not in place before the request, edits and deletions are usually gone: Microsoft only keeps earlier versions of edited Teams messages where a retention policy applies, and deleted messages are reachable through its export tools for 21 days. Sources: ICO guide to subject access, Microsoft Learn, Teams export APIs.
Email me my readiness report
Get a formatted PDF of these results by email, to keep or share with your team. We send it once and do not add you to any list.
Want help closing the gaps?
We help organisations put capture, retention and a tested process in place before the next request arrives, using the Microsoft tools you already own where they are enough and Mimecast Aware where they are not. C4C is an accredited Mimecast partner, and we will tell you if Purview alone is the right answer. Your results are filled in below so you can edit them before sending. No need to share any documents.
Why SAR readiness matters now
What has the ICO done about late or failed requests?
Late subject access requests are a recurring reason for ICO action. It reprimanded the Labour Party in August 2024 for failing to respond to requests for people’s own data (ICO), United Lincolnshire Teaching Hospitals NHS Trust after 32 percent of requests went unanswered within the one month limit (ICO), City of Edinburgh Council after 40 percent did (ICO), and Glasgow City Council, which answered only 45 percent on time (ICO). None of these were exotic failures: requests simply took longer than the law allows.
Has anyone been prosecuted for deleting records after a request?
Yes. In September 2025 the ICO announced that a care home director had been found guilty under section 173 of the Data Protection Act 2018 after blocking, erasing or concealing records to prevent them being disclosed following a subject access request, and ordered to pay a £1,100 fine and £5,440 in costs (ICO). Tidying up a Teams chat or Slack thread after a request arrives is exactly the kind of act the offence covers.
What does the law require today?
- One month to respond, extendable by up to two further months for complex or multiple requests, under the timing rules the Data (Use and Access) Act 2025 inserted, in force from 5 February 2026 (section 76).
- The clock pauses only for clarification about the information requested, not about the format of the response, and where you reasonably need proof of identity the clock does not start until you receive it (ICO).
- A reasonable and proportionate search, a rule the Act treats as having applied since 1 January 2024 (section 78).
- No exemption for archived or backed up data just because of how it is stored, and personal data staff hold on their own devices may need to be considered where you are the controller (ICO).
Where does Teams data actually live?
Not in one place. Microsoft stores Teams message data in different locations depending on the conversation: user mailboxes for chats, group mailboxes for standard channels and separate storage for shared channels (Microsoft Learn). Meeting recordings follow their own expiry settings, with up to 90 days to recover an expired recording from the recycle bin (Microsoft). A search that misses any of these misses part of the answer, which is why capture and a tested process matter more than the deadline itself.
Frequently asked questions
Do subject access requests cover Microsoft Teams and Slack messages?
Yes. A subject access request covers the personal data you hold about the person, wherever it sits, so messages in Teams chats and channels, Slack and other collaboration tools are in scope alongside email.
How long do we have to respond to a subject access request?
One month from receiving the request, which you can extend by up to two further months where the request is complex or the person has made several, as long as you tell them, and why, within the first month. Since the Data (Use and Access) Act 2025 the clock pauses while you wait for a clarification you genuinely need, and does not start until you have any proof of identity you asked for.
Can we delete Teams messages once a request arrives?
No. Once a request has been made it is an offence under section 173 of the Data Protection Act 2018 to alter, erase or conceal information with the intention of preventing its disclosure. Messages removed earlier under a genuine, consistently applied retention policy are different, but you should be able to show the policy.
Has anyone been prosecuted for deleting data after a subject access request?
Yes. In September 2025 the ICO announced that a care home director was found guilty under section 173 of the Data Protection Act 2018 after blocking, erasing or concealing records to prevent their disclosure following a request, and was ordered to pay a £1,100 fine and £5,440 in costs.
Do we have to search archived messages and personal devices?
The ICO says there is no exemption for archived or backed up information simply because of how it is stored, and that personal data staff hold on their own devices may need to be considered where the organisation is the controller. The search must be reasonable and proportionate, but the storage technology alone does not take data out of scope.
What happens if we answer subject access requests late?
The ICO can take action. It has reprimanded organisations including the Labour Party, United Lincolnshire Teaching Hospitals NHS Trust, City of Edinburgh Council and Glasgow City Council for failing to answer requests within the one month limit, in two council cases for 40 percent and 55 percent of requests.
Is Microsoft Purview enough to answer a SAR in Teams?
It can be, if your people work only in Teams, you own the premium eDiscovery tier through E5 or the E5 Compliance add on, and a retention policy was in place before the messages you need. Where Slack or Zoom are also used, or edits and deletions matter, a dedicated capture platform is usually needed.
What does this readiness check score?
Eight areas that decide whether a request reaching collaboration data can be answered on time: retention, capture of edits and deletions, search across a person, legal hold, time to produce, ownership, the stop the clock rules and the deletion offence. Two further questions, on platforms and request volume, shape the advice.
Is this legal advice?
No. It is a practical readiness check based on the ICO guidance and Microsoft documentation, to help you find gaps. Take legal advice on any specific request.
This check is practical guidance, not legal advice. Sources: ICO guide to subject access, Data Protection Act 2018, section 173, Microsoft Learn, Teams export APIs.