Exposing GDPR Non-Compliance: A Deep Dive into Mishandled Subject Access Requests

The core point: a SAR response should answer, not obscure

The concern raised in this article is that a subject access request made to Naylors Gavin Black LLP in April 2024 was met with delay, partial disclosure, heavy redaction and insufficient explanation about privilege, third-party sharing and the role of another firm.

A delayed or incomplete-looking SAR response may involve several possibilities: poor compliance, a legitimate exemption dispute, a disagreement about scope, a privilege issue, or a dispute about third-party data. That is why the strongest approach is to reduce the complaint to a clear set of accountability questions.

The public-interest point remains straightforward. Data rights are practical rights. They only work if organisations respond on time, explain what they have done, justify withholding, and avoid leaving the requester unable to understand how their personal data has been processed.

SAR framework: what the right of access is meant to do

The right of access allows an individual to obtain a copy of their personal data and supplementary information. It helps the individual understand how and why their data is being used, and whether that use is lawful.

A request does not need to use formal language. If it is clear that the individual is asking for their own personal data, the organisation should recognise it as a subject access request and deal with it through the correct process.

The timeline issue: partial response, final response and delay

The stated chronology is that the SAR was submitted on 4 April 2024, that an initial partial response was provided on 29 April 2024, and that a final response was provided on 28 June 2024.

If those dates are correct, the key question is not simply whether any response arrived within one month. The sharper questions are whether the first response was meaningful, whether any extension was properly available, whether the extension was communicated, whether the request was complex, and whether the final disclosure allowed the requester to understand what had been withheld.

Redactions, privilege and the danger of blanket explanations

The article raises concern about significant redactions and broad reliance on legal professional privilege. That may be an important issue. Legal professional privilege can justify withholding some material in the subject-access context, but it should not become a substitute for analysis.

A well-handled SAR response should allow the requester to understand the category of material withheld, the basis for withholding, and whether the organisation considered third-party information, confidentiality, privilege, legal advice or litigation context. It does not necessarily require disclosure of the privileged content itself.

Controller route: Naylors Gavin Black, Muckle LLP and direct access rights

The article raises concern that personal data was shared with Muckle LLP and that Muckle LLP was said to be a controller that would not engage unless authorised by Naylors Gavin Black LLP. That point needs careful separation because controller status, processor status, joint-controller status, agency, privilege and litigation context may all affect the route.

The practical question is not whether the requester was entitled to every document from every organisation on demand. The question is whether each organisation’s role was clearly explained, whether any direct SAR to a controller was recognised, and whether any refusal or redirection was properly justified.

The accountability test: what a proper challenge should show

Strong language about transparency failure and obstruction is less effective than a well-structured challenge. The stronger route is to reduce the dispute to request, deadline, search, disclosure, redaction, exemption, controller role and remedy.