Are there any special cases?
-
This guidance has been updated to reflect changes to the right of access brought about by the Data (Use and Access) Act. Some of these changes are not yet in force. However, we think it is useful for it to be published now so that you are ready for these changes. In particular, they set out that you only have to carry out a reasonable and proportionate search in response to a SAR; and that you can ‘stop the clock’ when asking for clarification on a request.
Latest updates - 08 December 2025
08 December 2025 - the right of access guidance was updated.
In more detail
Special cases
There are special rules and provisions about SARs and some categories of personal data, including:
- unstructured manual records;
- credit files;
- health information;
- educational information; and
- social work information.
These are all covered in the following sections.
Unstructured manual records
Unstructured manual records relate to information held in a non-automated format which is not, or is not intended to be, part of a ‘filing system’.
Data protection law only applies to information held in unstructured manual records if a public authority is processing it. This includes paper records that public authorities do not hold as part of a filing system.
Therefore, public authorities may have to search such information to comply with a SAR.
However, they are not obliged to do so if:
- the request does not contain a description of the unstructured information; or
- the estimated cost of complying with the request would exceed the appropriate maximum.
The ‘appropriate maximum’ is currently £600 for central government, Parliament and the armed forces, and £450 for all other public authorities.
When estimating the cost of compliance, you must only take into account the cost of the following activities:
- Determining whether you hold the information.
- Finding the requested information or records containing the information.
- Retrieving the information or records.
- Extracting the requested information from records.
The biggest cost is likely to be staff time. You must rate staff time at £25 per person per hour, regardless of who does the work (including external contractors). This means a limit of 18 or 24 staff hours, depending on whether the £450 or £600 limit applies.
For further information, see the Fees Regulations made under section 12(5) of FOIA. These regulations apply to all public authorities in England, Scotland, Wales and Northern Ireland, for the purposes of estimating the costs of responding to SARs for unstructured manual records.
Personal information held in an unstructured manual record (by a public authority) is also exempt from disclosure if it is about appointments, removals, pay, discipline, superannuation or other personnel matters related to service in:
- any of the armed forces of the Crown;
- any office or employment under the Crown or under any public authority;
- any office or employment, or under any contract for services, in respect of which, power to take action, or to determine or approve the action taken in such matters, is vested in:
- His Majesty;
- a Minister of the Crown;
- the National Assembly for Wales;
- the Welsh Ministers;
- a Northern Ireland Minister (within the meaning of FOIA); or
- an FOI public authority (as defined in FOIA or FOISA).
Credit files
The DPA has special provisions about access to personal information held by credit reference agencies. Unless otherwise specified by the requester, a SAR to a credit reference agency only applies to information relating to the person’s financial standing. Credit reference agencies must also inform people of their rights under section 159 of the Consumer Credit Act 1974 when responding to a SAR.