The right of access is an important part of UK data protection law, allowing individuals to understand how organisations use their personal information and to obtain a copy of their personal data. Responding to a data subject access request can, however, create a significant practical challenge, particularly where information is held across different systems, teams and records.
Handling a data subject access request (DSAR) can require input from several parts of an organisation. Relevant personal data may be held in email accounts, HR systems, shared drives, case-management systems, financial records, messaging platforms or by third-party processors. Identifying what needs to be searched, coordinating those searches and reviewing the information gathered can therefore become resource-intensive.
Alongside this practical challenge, organisations must comply with the requirements of the UK GDPR and the Data Protection Act 2018. This includes responding within the applicable timeframe, providing the information individuals are entitled to receive and considering carefully whether any exemptions or restrictions apply.
This guide looks at some of the practical aspects of managing DSARs, including recognising the right of access, defining the scope of a request, identifying relevant information, coordinating searches, reviewing the information gathered and preparing a response.
A structured approach can make DSARs easier to manage, particularly where requests are complex or information is spread across different parts of an organisation. It can also help organisations maintain a clear record of how a request was handled and the decisions made during the process.
What exactly is a Data Subject Access Request?
A Data Subject Access Request (DSAR) is a request made by an individual exercising their right of access under Article 15 of the UK GDPR. The right allows individuals to obtain confirmation about whether their personal data is being processed, access to that personal data and certain information about how and why it is being processed.
Key aspects of DSARs include:
Right of access: Article 15 of the UK GDPR gives individuals the right to obtain access to their personal data and specified information about how that data is being processed.
Information requested: An individual may make a broad request for access to their personal data or limit their request to particular information, records, time periods or processing activities. The right is to a copy of the individual’s personal data, rather than necessarily to copies of every original document in which that data appears.
Response timeframe: Organisations must respond without undue delay and normally within one month of receiving the request. Where a request is complex or the individual has made a number of requests, the response period may be extended by up to a further two months. If an extension is required, the individual must be informed within the initial one-month period and told why the extension is necessary.
The calculation of the response period can be affected in certain circumstances, including where the organisation reasonably requires further information to confirm the requester’s identity or clarify the information requested.
Restrictions and exemptions: The right of access is not absolute. In some circumstances, an organisation may be able to refuse to act on a request that is manifestly unfounded or excessive. Specific exemptions or restrictions may also affect whether particular information must be disclosed, and additional consideration is required where responding would involve disclosing personal data relating to another individual.
Common scenarios: DSARs can arise in many contexts and may be made by customers, employees, former employees, service users or other individuals whose personal data an organisation processes. Requests arising in an employment, complaint or dispute context can be particularly resource-intensive because relevant personal data may be spread across emails, documents, messaging systems and records held by different teams.
In most cases, organisations must respond to a DSAR free of charge. In certain circumstances, including where a request is manifestly unfounded or excessive, a reasonable fee may be charged or the organisation may be able to refuse to act on the request. A reasonable fee may also be charged where an individual requests further copies of their personal data. Where a request is made electronically, the information should normally be provided in a commonly used electronic format unless the individual requests otherwise.
Common DSAR challenges for UK organisations
Responding to a DSAR can create a significant operational burden, particularly where personal data is held across multiple systems or teams. The challenge is not simply locating information within the required timeframe; organisations also need to determine what constitutes the individual’s personal data, review the material gathered and consider whether any information requires further assessment before disclosure.
A clear process, appropriate allocation of responsibilities and good information management can make requests considerably easier to coordinate and reduce the risk of delay, inconsistent searches or inappropriate disclosure.
Organisations can face several practical challenges when handling DSARs:
Resource intensity and time constraints: Fulfilling requests often requires staff to divert from their primary responsibilities to search through various systems and records within the strict one-month timeframe.
Identifying relevant data sources: Personal data may be held across multiple systems, departments and third-party processors, making it important to understand where relevant information is likely to be located. Up-to-date records of processing activities, data maps or other information about where personal data is held can make this process easier to coordinate.
Scope uncertainties: Determining what information falls within the scope of a request can be challenging, particularly where a request is broad or where relevant personal data may be contained within a large volume of records. Organisations may need to consider carefully what the individual is asking for and, where appropriate, seek clarification to help identify the information or processing activities to which the request relates.
Third-party information and redaction: Information gathered for a DSAR may also contain personal data relating to other individuals. Organisations need to consider carefully whether that information can be disclosed and whether information should be redacted or withheld before the response is provided.
Applying exemptions and restrictions: Some information may require particular consideration before disclosure, for example where it involves legal professional privilege, confidential references, management information or the rights of other individuals. Whether an exemption or restriction applies will depend on the circumstances, and organisations should ensure that decisions to withhold information have an appropriate basis and are properly documented.
A documented and repeatable DSAR process can reduce the administrative burden of responding to requests. Clear responsibilities, established search arrangements, appropriate templates and a consistent method for recording decisions can help organisations manage requests more efficiently and provide a clearer audit trail of how each request was handled.
The critical role of proper DSAR scoping
Imagine receiving a DSAR from a former employee who simply states, "Please provide all information you hold about me."
A broadly worded request can require searches across a range of locations, potentially including emails, HR records, payroll information, messaging systems, CCTV footage, access records and other systems in which the individual’s personal data may be held. Establishing the scope of the request and identifying the relevant data sources at an early stage can therefore be an important part of planning an effective response.
Establishing the scope of the request
Scoping involves understanding what the individual is requesting and identifying the information, systems, time periods and relevant teams that may need to be considered. A clear scope can help an organisation plan proportionate searches, allocate responsibilities and reduce the risk of relevant personal data being overlooked or unnecessary information being gathered.
Organisations are required to make reasonable and proportionate efforts to locate the personal data covered by a request. The organisation should be able to explain the approach taken to its searches, including why the systems, locations and search criteria used were considered appropriate in the circumstances. Where an organisation processes a large amount of information about an individual, it may ask the individual to specify the information or processing activities to which the request relates before providing the information. Any request for clarification should be reasonable and genuinely necessary to help the organisation respond to the request. Clarification should not, however, be used simply to narrow a request that can reasonably be understood and responded to.
Categorising information for review
Once potentially relevant information has been gathered, categorising it can help structure the review process. The categories used will depend on the request, but it can be helpful to distinguish between information that is clearly relevant, material that does not contain the requester’s personal data, and information requiring further assessment before a disclosure decision is made.
Information clearly relevant to the request
This may include personal data about the individual contained within records that are relevant to the request. Depending on the circumstances, relevant information might be found in:
personnel and HR records;
correspondence and emails;
financial or transaction records;
case-management or customer records;
messaging and collaboration systems; and
images, audio recordings or CCTV footage.
The fact that a document or record contains the individual’s name does not necessarily mean that the whole document constitutes their personal data. The information should be considered in context and against the scope of the request.
Information not relevant to the request
Material gathered during searches may not necessarily contain the requester’s personal data or fall within the scope of the request. Identifying this material during the review can help avoid unnecessary further processing.
Examples might include:
information that does not relate to or identify the requester;
records falling outside an agreed or clearly specified date range or subject matter;
genuinely anonymised information that no longer identifies the individual; and
duplicate material where the same personal data has already been identified for review.
Information should not be treated as out of scope simply because it also relates to another individual, is confidential or may be subject to an exemption. Those matters require separate consideration as part of the disclosure review.
Information requiring further assessment
Some information identified during the review may require further assessment before a decision is made about disclosure. This does not necessarily mean that the information falls outside the scope of the DSAR or should be withheld.
Examples may include:
information containing personal data about both the requester and other individuals;
emails, messages or meeting records in which the requester is discussed;
opinions or assessments relating to the requester;
confidential or legally sensitive information; and
information that may be affected by a relevant exemption or restriction.
Decisions about whether particular information should be disclosed, redacted or withheld should be made by the organisation or the appropriate data protection or legal adviser, with the reasoning documented where appropriate.
Common scoping pitfalls
Common problems when establishing and managing the scope of a DSAR include:
failing to identify all relevant systems, teams or information owners;
asking for clarification unnecessarily where the request can already be reasonably understood;
using search terms or date ranges that are too narrow to identify relevant personal data;
gathering excessive volumes of material without a clear search methodology;
failing to document the searches undertaken and the scope decisions made; and
applying different search or review approaches without recording the reason for the difference.
Coordinating the search process
Once the scope and likely sources of relevant personal data have been identified, the search process should be coordinated across the appropriate teams and information owners. Clear instructions about what is being searched for, the relevant time period and how information should be returned can help make the collection process more consistent and manageable.
Maintaining a record of the systems searched, the people involved, the search terms or criteria used and the information returned can also provide a useful audit trail. This can help the organisation track progress, identify gaps and demonstrate the approach taken to locating information covered by the request.
When additional DSAR support can help
DSARs can create significant peaks in workload, particularly where a request involves large volumes of information, multiple systems or contributions from several teams. Organisations may have the necessary data protection expertise internally but still need additional capacity to coordinate the practical work involved in responding to a request.
External support can help bring structure to the process by coordinating information gathering, maintaining records and trackers, organising material for review and following up with the relevant teams. The organisation and its appropriate data protection or legal advisers remain responsible for determining the applicable legal requirements and making decisions about disclosure, exemptions and other substantive data protection matters.
When to consider external support
Additional support may be particularly useful where:
a DSAR creates a temporary increase in workload that the existing team does not have capacity to absorb;
relevant information is spread across several systems, teams or information owners;
significant volumes of emails, documents or other records need to be gathered, organised and tracked;
several DSARs need to be managed at the same time;
the organisation needs a clearer process, tracker or audit trail for managing requests;
internal data protection, HR, Legal or Compliance teams need practical support with the administrative stages of a complex request; or
organisational change, such as restructuring, has increased the volume or complexity of information that needs to be coordinated.
Benefits of additional DSAR support
Independent practical support
DSARs can become particularly demanding where they arise alongside employment matters, complaints or disputes. Independent practical support can help keep the administrative process structured and focused, particularly when large volumes of information need to be gathered from different teams, organised for review and tracked through to completion.
Supporting a consistent process
Additional support can help an organisation apply its agreed DSAR process consistently, particularly where a request involves multiple teams or a significant volume of information. Maintaining clear trackers, recording searches and responses from information owners, organising material for review and keeping an audit trail of actions and decisions can make the overall process easier to manage and oversee.
Resource optimisation
DSARs can require substantial administrative input, particularly during the information-gathering and review stages. Bringing in additional support can provide temporary capacity without requiring internal specialists or senior staff to undertake every administrative task themselves. This allows those responsible for data protection, Legal, HR or Compliance to focus their time on the areas requiring their judgement and expertise while the practical coordination and document-management work continues alongside them.
Reduced internal disruption
A DSAR may require input from several teams, including HR, IT, Legal, Compliance and relevant business areas. Additional support can coordinate information requests, follow up outstanding responses and maintain a central record of what has been requested and received. This can reduce the amount of administrative coordination required from internal teams while keeping the appropriate information owners and specialists involved where their input or judgement is needed.
How additional support can work in practice
The practical support required will vary depending on the nature of the request, the volume of information involved and the organisation’s existing resources. The following scenarios illustrate where additional capacity can be particularly useful.
Scenario 1: The high-volume challenge
Imagine your organisation receives several DSARs following a restructuring exercise. Internal HR, Legal or data protection teams may already be managing the substantive issues arising from the restructure, while each DSAR generates additional searches, correspondence, documents and deadlines to coordinate. Additional support could help establish a tracker, coordinate searches with the relevant information owners, organise the material returned and monitor progress, leaving the organisation’s appropriate specialists to focus on the decisions requiring their judgement.
Scenario 2: The complex, sensitive request
Consider a situation where a former employee makes a DSAR alongside an employment dispute or potential tribunal claim. The request may involve extensive email correspondence, HR records, meeting notes and communications involving several individuals. Additional support could coordinate the searches, collate and organise the information returned, identify material requiring further review and maintain a record of decisions and agreed redactions. The organisation’s appropriate data protection, HR or legal advisers would remain responsible for determining whether particular information should be disclosed, redacted or withheld and whether any exemption or restriction applies.
Scenario 3: Improving the DSAR process
An organisation that has experienced difficulties coordinating previous DSARs may decide to review how its process works in practice. Additional support could help map the existing process, identify administrative gaps or bottlenecks, bring together input from relevant teams and support the development of clearer procedures, templates, trackers and responsibilities. Any changes requiring legal or specialist data protection judgement would remain for the organisation and its appropriate advisers to determine.
How Corporate Assist can support the DSAR process
Responding to a DSAR can involve a considerable amount of practical coordination, particularly where information needs to be gathered from different systems, teams and individuals. Corporate Assist can provide additional capacity to help organise and manage that work alongside your existing data protection, Legal, HR or Compliance arrangements.
Support can include helping to establish the scope and search parameters agreed by the organisation, identifying relevant information owners and data sources, coordinating searches, following up outstanding information and maintaining a central tracker of progress. Information returned can then be collated, organised and prepared for review, helping the appropriate internal teams or specialist advisers work through the material more efficiently.
Where information requires further assessment—for example because it contains third-party personal data, potentially sensitive material or information that may be subject to an exemption—Corporate Assist can identify and organise that material for review, record the decisions made and support the implementation of agreed redactions or other actions.
Corporate Assist can also support the administrative preparation of the response, maintain the supporting records and action trail, and help ensure that the different stages of the process continue to move forward within the organisation’s agreed timetable.
Responsibility for determining the organisation’s legal obligations, deciding whether information should be disclosed or withheld, applying exemptions and approving the final response remains with the organisation and its appropriate data protection or legal advisers.
Practical DSAR support when you need additional capacity
DSARs can place significant demands on internal teams, particularly where large volumes of information need to be located, gathered, organised and reviewed within a limited timeframe.
Corporate Assist can provide practical additional capacity alongside your existing teams and specialist advisers, helping to coordinate information gathering, maintain trackers and supporting records, organise material for review and follow up the actions needed to keep the response process moving.
Support can be provided for an individual complex request, during periods of increased DSAR activity or as part of a wider project to improve the organisation’s DSAR processes and supporting documentation. Responsibility for legal and data protection decisions remains with the organisation and its appropriate advisers.
If your organisation needs additional capacity to support a DSAR or improve the practical processes around handling requests, please get in touch to discuss your requirements.
Share this post: