In today's data-driven world, the right of individuals to access their personal information has moved from an obscure legal provision to a mainstream privacy expectation. Organisations across the UK are experiencing a steady increase in Data Subject Access Requests (DSARs), requiring them to locate, compile, and share personal data with the individuals it concerns, often under tight deadlines and complex compliance requirements.
As I work with a range of clients across various sectors, I've observed a growing anxiety around handling DSARs effectively. Many organisations struggle with the tension between meeting their legal obligations and managing the administrative burden that these requests create.
With the UK GDPR setting clear expectations (and substantial penalties for non-compliance), understanding how to respond professionally to these requests has become an essential business competency rather than just a compliance exercise.
In this guide, I will walk you through some of the practical aspects of managing DSARs. We’ll cover all the steps, from recognising valid requests and defining their scope to delivering compliant responses within the required timeframe.
So, whether you've handled numerous requests or are preparing for your first, this guide should help you master the DSAR process and offer you the opportunity to demonstrate transparency, strengthen trust with customers and employees, and improve your overall data management practices.
What Exactly Is a Data Subject Access Request?
A Data Subject Access Request (DSAR) is a formal exercise of an individual's right to access their personal data under Article 15 of the UK GDPR. It enables people to obtain confirmation that an organisation is processing their personal information and to receive a copy of that data.
Statista reported that 36% of internet users exercised their DSAR rights globally in 2024, up from 24% in 2022. In the UK specifically, 57% of respondents were aware of local privacy laws, indicating that there’s a growing public consciousness about data privacy rights.
Key aspects of DSARs include:
Legal basis: Article 15 of the UK GDPR grants individuals the right to access personal data that organisations hold about them.
Types of information: Individuals can request all copies of personal data an organisation holds about them or specific categories (such as employment records, marketing data, or CCTV footage).
Response timeframe: Organisations must respond without undue delay and within one month of receipt, with the possibility of a two-month extension for complex or numerous requests.
Valid refusal grounds: Requests can be refused if they are manifestly unfounded or excessive, would reveal another person's data, or fall under specific exemptions (such as legal privilege or law enforcement).
Common scenarios: While customer DSARs are increasing, it’s actually employee requests that represent the largest category. A staggering 66.8% of DSARs are initiated by employees, significantly outpacing requests from customers or other groups. Thus, in many cases, you will find yourself fielding DSARs from your own employees, making how you handle them even more important.
In most cases, organisations cannot charge a fee for fulfilling a DSAR and must provide the information in a commonly used electronic format if the request was made electronically.
Common DSAR Challenges for UK Organisations
The requirement to provide personal data promptly and without charge creates significant operational challenges for many organisations.
In my consulting work, I've found that profit-focused enterprises often view DSARs as unwelcome distractions from revenue-generating activities. This dismissive attitude quickly shifts, however, it's highlighted that in 2024 alone, the ICO handed out £1.27 million in fines related to data protection non-compliance.
Nothing focuses the mind quite like the prospect of significant financial penalties!
Beyond the financial risks, organisations typically face several practical challenges when handling DSARs:
Resource intensity and time constraints: Fulfilling requests often requires staff to divert from their primary responsibilities to search through various systems and records within the strict one-month timeframe.
Identifying relevant data sources: Many organisations store personal data across multiple systems, departments, and even third-party processors, making comprehensive data gathering extremely difficult without proper data mapping in place.
Scope uncertainties: Determining what information falls within the scope of a request can be challenging, especially when requests are broadly worded as "all information you hold about me."
Redaction issues: Documents often contain personal information about multiple individuals, requiring careful redaction to protect third-party privacy rights while still fulfilling the request.
Balancing competing interests: Organisations must navigate the tension between transparency obligations and legitimate business interests, including protecting confidential information and intellectual property.
In my experience supporting organisations through their DSAR processes, those that invest in establishing efficient procedures and response templates find that the operational burden decreases significantly over time. Meanwhile, those that treat each request as a one-off emergency typically spend more resources and face greater compliance risks.
The Critical Role of Proper DSAR Scoping
Imagine receiving a DSAR from a former employee who simply states, "Please provide all information you hold about me."
Without proper scoping, your team might spend weeks combing through years of emails, performance reviews, payroll records, CCTV footage, building access logs, and countless other systems where their personal data might appear.
The Foundation of Effective Response
Scoping is the process of defining the boundaries of what information needs to be provided in response to a request. It serves as the critical first step that determines the efficiency and compliance of your entire DSAR process. When done correctly, scoping can significantly decrease the risk of both over and under-disclosure, both of which carry compliance risks.
It's worth noting that under UK GDPR, organisations are only required to carry out a "reasonable search" of their records. The law doesn't expect you to unearth every possible mention of the requester's name across all systems, which is why seeking clarification about exactly what information they're looking for can be both compliant and efficient – a point we'll explore further in the next section.
Creating a Systematic Categorisation Framework
Successful DSAR processing requires a methodical approach to categorising information:
Clearly In-Scope Data encompasses information that indisputably falls under the definition of the requester's personal data.
This typically includes:
Personnel files and HR records
Direct correspondence where the individual is identified
Financial transactions linked to the individual
Medical or health information, where applicable
Images or recordings of the individual
Clearly Out-of-Scope Data should be identified early to avoid unnecessary work:
Purely business information with no personal identifiers
Anonymous or aggregated statistical data
Information about other individuals (unless inseparable from the requester's data)
Documentation covered by legal privilege
Grey Areas Requiring Assessment typically need careful evaluation by someone with data protection expertise:
Emails that mention the individual but aren't about them
Meeting minutes where the individual is referenced
Opinions expressed about the individual by others
Information that sits at the boundary between personal and business data
Scoping Pitfalls to Avoid
Common traps when scoping DSARs include:
Taking requests at face value without seeking necessary clarification
Failing to document scoping decisions, making future similar requests harder to handle
Over-collecting information "just in case," which leads to excessive review time
Applying inconsistent scoping criteria across different requests
Not considering exemptions early in the process
Efficient Approach to Scoping
When properly executed, scoping transforms DSARs from overwhelming burdens into manageable processes. Organisations that implement structured approaches to scoping, such as bringing together data owners from different departments at the start of the process, generally achieve better results with less effort.
The time invested in thoughtful scoping pays dividends throughout the DSAR lifecycle, creating clarity for all stakeholders and ensuring that the subsequent steps of collection, review, and disclosure build on a solid foundation.
The Strategic Advantage of Outsourcing DSAR Management
As data subject access requests become increasingly complex and resource-intensive, many organisations are turning to external specialists to manage this critical compliance function.
If you're finding DSARs drain your team's time and attention, outsourcing might offer a strategic solution.
When to Consider External Support
Consider external DSAR management support when:
Your team lacks dedicated data protection expertise
Request volumes are unpredictable, creating resource planning challenges
You face complex requests requiring specialised knowledge
Internal resources are stretched thin handling existing workloads
You've experienced compliance issues with previous DSARs
Your organisation is undergoing significant change (mergers, restructuring)
Benefits of Specialist DSAR Expertise
Objective Third-Party Perspective
When handling sensitive requests (particularly those from disgruntled employees or in pre-litigation scenarios), an external specialist brings valuable objectivity. Without internal politics or historical relationships clouding judgment, they can make consistent, compliance-focused decisions about what information should be disclosed.
Enhanced Compliance Assurance
External specialists who focus exclusively on data protection matters stay current with regulatory changes, enforcement trends, and evolving best practices. This specialisation provides greater confidence that your DSAR responses meet current compliance standards, which is especially important given the ICO's increasingly active enforcement approach.
Resource Optimisation
Transferring the administrative burden of DSARs to a specialist corporate support service provider allows you to redirect internal resources to core business activities. This approach often proves more cost-effective than pulling senior staff away from their primary responsibilities or maintaining in-house expertise for fluctuating request volumes.
Reduced Internal Disruption
Each DSAR typically requires input from multiple departments (HR, IT, legal, and business units). External management can significantly reduce this cross-departmental disruption through streamlined information gathering processes and clear, focused requests to internal teams.
How Outsourcing Improves DSAR Handling
It would probably be helpful if I ran through some scenarios to better illustrate the potential benefits of external DSAR management.
Scenario 1: The High-Volume Challenge
Imagine your organisation suddenly receives multiple complex DSARs following a restructuring announcement. Rather than rushing internal staff through unfamiliar procedures, an external specialist could apply established protocols to manage the spike in volume without compromising quality or compliance.
Scenario 2: The Complex, Sensitive Request
Consider a situation where a former employee makes a DSAR as a prelude to an employment tribunal claim. An external specialist would bring both the technical expertise to properly scope and fulfil the request and the emotional distance to objectively assess what information should be disclosed, redacted, or withheld under appropriate exemptions.
Scenario 3: The Compliance Improvement Journey
If your organisation has previously struggled with DSAR compliance, bringing in external expertise doesn't just solve your immediate challenge; it provides an opportunity to develop improved internal policies, processes, and procedures. External specialists can help establish procedures, templates, and training that enhance your capability to handle future requests more effectively.
Partnering with a specialist who manages DSARs day in and day out also gives you access to experience and expertise that would be impractical to maintain in-house, particularly if your DSAR volumes don't justify a dedicated full-time resource.
How Corporate Assist Supports Your DSAR Obligations
When you receive a DSAR, my first priority is helping you understand exactly what information falls within its scope.
In my experience, many organisations initially struggle to determine what should be included or excluded from their response. I will carefully analyse the request and categorise the relevant information into clear groups: clearly in-scope data that must be provided, out-of-scope material that can be legitimately excluded, and grey areas requiring further assessment.
This initial scoping process is critical. It ensures you meet your legal obligations without unnecessarily revealing sensitive information that falls outside the request's legitimate parameters.
After defining the appropriate scope, I will work with you to systematically gather the required information from your systems, meticulously organising it into a structured format that makes the data both accessible to the requester and defensible from a compliance perspective.
Each document undergoes a thorough review, with careful redaction of confidential information and third-party personal data that shouldn't be disclosed. Throughout this process, I maintain open communication with your team, checking any questionable items to ensure we're aligned on the response approach.
The final product you receive isn't just a bundle of documents. It's a professionally packaged, compliant DSAR response that protects your organisation's interests while satisfying your legal obligations. I structure responses specifically for your organisation's particular data responsibilities, ensuring all necessary information is included while preventing over-disclosure of sensitive materials.
Having managed countless DSARs across various sectors, I bring the expertise to navigate complex requests efficiently, allowing your team to focus on core business activities with confidence that your compliance obligations are being handled properly.
Receive Flexible Expert DSAR Support When You Need It Most
Managing DSARs effectively requires careful scoping, methodical processing, and compliance expertise – skills that many organisations find challenging to maintain in-house.
I've helped countless businesses transform their DSAR response processes from sources of stress into streamlined, compliant operations that protect both data subjects' rights and organisational interests.
My services help you shift your mindset from regulatory box-ticking into a focused commitment to upholding data protection principles and building trust with employees, customers, and stakeholders.
If you're facing DSAR challenges or simply want to ensure your processes meet best practice standards, I'm here to help. You can reach me directly at 07576 829 591 or amy@corporateassist.co.uk to discuss how I can support your specific DSAR requirements. Based in Hertfordshire but serving clients nationwide, I provide the expertise you need without the overhead of a full-time data protection specialist.
Share this post: