Written by Subject access requests
A subject access request is meant to give people practical access to their own personal data. The problem arises when an organisation gives an incomplete, delayed or over-redacted response, and the ICO then decides that the complaint does not justify formal regulatory action. At that point, the data subject needs more than frustration. They need a route map.
Publication snapshot
- The right of access is a practical right, not a courtesy. It allows people to obtain their personal data and understand how it is being used.
- The ICO may consider complaints about failed or inadequate subject access responses, but a complaint does not automatically produce enforcement action.
- The public-confidence issue is whether complainants receive enough reasoning to understand why no formal action was taken and what route remains open.
- A stronger SAR complaint separates evidence, chronology, legal right, harm, missing material and requested outcome.
Why SARs matter
A subject access request, often called a SAR, is one of the most important practical rights in data protection law. It lets a person ask an organisation whether it is processing their personal data, obtain a copy of that data, and receive supplementary information about how the data is being used.
That matters because personal data is often the evidence behind decisions. It may explain a workplace dispute, medical record, safeguarding record, housing decision, financial assessment, insurance outcome, education file, litigation position or internal complaint. When the response is delayed, incomplete or heavily redacted, the issue is not only administrative inconvenience. The person may be unable to understand the record being used against them or about them.
The practical point: a failed SAR can become an evidence-access problem. If the missing data is needed for a complaint, claim, appeal or safeguarding concern, delay and over-redaction can materially affect the person’s ability to act.
The legal route
The ordinary right of access is anchored in the UK GDPR. In broad terms, a person is entitled to confirmation that their personal data is being processed, a copy of that personal data, and supplementary information about the processing. Controllers, not processors, are responsible for responding to SARs.
In most cases, an organisation must respond without undue delay and within one month. There are limited circumstances where the response period can be extended, including complexity or multiple requests, but the organisation should explain the extension within the relevant period. The Data (Use and Access) Act 2025 also affects the developing framework for data subject rights, including clarification of time-limit and search issues.
Make the SAR clearly
Identify the personal data sought and, where useful, the relevant dates, systems, teams, correspondence, recordings or records.
Record the deadline
Keep the date sent, proof of delivery, any identity-check request, any clarification request and any extension notice.
Check the response
Compare the response against the request. Look for missing categories, unexplained redactions, absent attachments, omitted metadata or missing call recordings.
Escalate with precision
Before complaining externally, tell the organisation what is missing and ask for a corrected response, reasons, or an internal review.
It is important not to blur the ordinary UK GDPR SAR route with separate access regimes. Some law-enforcement processing is dealt with under Part 3 of the Data Protection Act 2018. Health, education, social work, safeguarding and litigation records may also raise specific exemptions or third-party data issues. The legal route should therefore be identified before the complaint is framed.
The enforcement gap
The ICO can consider complaints about failures to comply with SARs. It also has formal regulatory powers, including warnings, reprimands, information notices, assessment notices, enforcement notices and monetary penalty notices. But the existence of those powers does not mean every individual complaint will produce formal action.
This is where many complainants experience the enforcement gap. An organisation may have responded late, searched poorly, redacted heavily, omitted records or failed to explain its exemptions. The complainant may still receive an ICO outcome that records concern, gives advice, or closes the matter without formal enforcement.
What the complainant sees
A missed deadline, incomplete disclosure, opaque redactions, poor correspondence and an outcome that feels practically useless.
What the regulator may assess
Evidence strength, seriousness, repeat behaviour, wider harm, proportionality, available powers, organisational response and regulatory priority.
What public confidence requires
Clear reasoning, transparent thresholds, accessible review routes and enough data to show whether individual complaints reveal wider patterns.
The criticism is not that every SAR complaint should lead to a fine or enforcement notice. That would be unrealistic. The stronger concern is that unclear closure decisions can make the right of access feel weaker in practice than it appears on paper.
The referral problem
Some organisations may treat “you can complain to the ICO” as the end of the conversation. In a compliant system, that referral is part of transparency. In a weaker system, it can become a deflection device: the organisation gives an inadequate response, points the person to the regulator, and waits to see whether the individual has the energy, evidence and resources to continue.
The concern is especially acute where the missing data may matter in another dispute. If a SAR is being used to obtain records for employment, housing, medical, financial, family, safeguarding or litigation purposes, delay can have tactical value. A late or incomplete response may not need to defeat the person’s rights permanently. It may only need to slow them down long enough to weaken the next step.
Incomplete disclosure
The response omits expected material, gives unexplained redactions or fails to include supplementary information.
Regulatory referral
The organisation points the person to the ICO instead of correcting the response or explaining the search and exemptions properly.
Low practical consequence
If the matter closes without formal action, the organisation may face little immediate pressure to revisit the missing evidence.
Rights without remedy
The person may still have legal options, but the regulatory route has not delivered the practical disclosure they needed.
This does not prove bad faith in any particular case. It identifies a structural risk. If organisations believe that weak SAR handling is unlikely to attract meaningful scrutiny, the deterrent effect of the right of access is reduced.
The practical complaint test
A stronger SAR complaint does not simply say that the organisation acted unfairly. It explains what was requested, what was provided, what is missing, why the missing material should exist, and why the failure matters.
The request
Keep the original SAR, proof of sending, identity correspondence, clarification requests and any agreed scope.
The response
Preserve the disclosure bundle, covering letter, exemption explanations, redaction schedule and any list of systems searched.
The missing material
Identify expected records by date, sender, recipient, system, topic or document type. Avoid vague assertions where a document trail is possible.
The harm or consequence
Explain why the missing data matters: delay, inability to correct records, inability to evidence another complaint, distress or loss of control.
The key distinction
An ICO complaint is not the same as a claim for compensation, a court application for compliance, or a judicial review of the regulator’s conduct. Those routes have different tests, evidence requirements, risks and time sensitivity.
Options after an ICO outcome
If the ICO closes a SAR complaint without formal action, the next step should be chosen carefully. A long emotional escalation is rarely the best first move. The better approach is to identify the route, deadline and evidence gap.
Ask the organisation again
Pros: low cost, may correct a narrow omission. Cons: may cause delay if the organisation has already taken a fixed position.
Use the ICO review or service route
Pros: may clarify reasoning or handling errors. Cons: may not produce disclosure or compensation.
Consider direct legal action
Pros: may focus on compliance or compensation. Cons: court routes involve evidence, costs risk and procedural discipline.
Consider public-law challenge
Pros: may be relevant where the regulator’s handling is arguably legally flawed. Cons: judicial review is time-sensitive and requires specialist review.
The central practical point is that a closed ICO complaint should not automatically end the matter. It should trigger a route decision: correction request, fresh SAR, targeted complaint, direct claim, regulatory escalation, or solicitor review.
Source anchors
These official sources help separate the current right, the complaint route, enforcement powers and reform context:
- ICO right of access guidance — current detailed guidance on SARs and the right of access.
- ICO: what is the right of access? — explains what people are entitled to receive.
- ICO: responding to a SAR — explains timing, extensions and clarification issues.
- ICO: enforcement of the right of access — explains complaint, enforcement, court order and compensation routes.
- GOV.UK: Data (Use and Access) Act factsheet — summarises current reforms affecting UK GDPR and the Data Protection Act 2018.
- ICO: make a complaint — public-facing complaint route.
Closing point
The right of access is only meaningful if people can use it in practice. The ICO does not have to take formal enforcement action in every individual SAR complaint. But where complaints are closed without formal action, the reasoning needs to be clear enough to preserve confidence in the right itself. Otherwise, organisations may learn the wrong lesson: that poor disclosure is a manageable inconvenience rather than a regulatory risk.
Legal Lens decision support
Get a free written assessment before escalating a SAR dispute
If your SAR response is late, incomplete or over-redacted, the next step should be evidence-led. A short review can help separate complaint strategy, legal route, missing documents and risk before you send a long escalation.
What to send
The original request, response bundle, redaction explanation, ICO complaint and outcome letter.
What the review tests
Whether the issue is missing evidence, poor reasoning, incorrect exemption use, delay, or a different legal route.
What it does not promise
It does not guarantee disclosure, provide regulated legal services, or replace solicitor advice where litigation is needed.
Independent Legal Lens consultancy. This is not a regulated solicitors’ firm. A preliminary assessment is not a substitute for regulated legal advice where that is needed.