Subject access request self serve

The UK GDPR places a high expectation on you to provide information in response to a SAR.

You should make reasonable efforts to find and retrieve the requested information. However, you are not required to conduct searches that would be unreasonable or disproportionate to the importance of providing access to the information. To determine whether searches may be unreasonable or disproportionate, you must consider:

• the circumstances of the request;
• any difficulties involved in finding the information; and
• the fundamental nature of the right of access.

The burden of proof is on you to be able to justify why a search is unreasonable or disproportionate.

Even where searching for certain information may be unreasonable or disproportionate, you must still search for any other information within the scope of a request. You should also consider whether further information from the individual will help you find the information they have requested.

You should ensure that your information management systems are well-designed and maintained, so you can efficiently locate and extract requested information and, where necessary, redact third-party data.

Find out more here:

• How do we find and retrieve the relevant information
• What efforts should we make to find information?
• ‘What about our information management systems?’.