Written by The ICO is often seen as the public’s route to transparency and data protection accountability. In practice, those who need evidence for legal disputes may find a slower, narrower and more reactive regulator than they expected.
Publication snapshot
- The article examines the gap between the ICO’s public-facing role and the experience of people seeking practical enforcement.
- It explains why Subject Access Requests can disappoint when used as a substitute for litigation disclosure.
- It distinguishes data protection rights from court disclosure, FOI rights and broader evidential strategy.
- It gives practical, lawful ways to frame complaints around process, deadlines, incomplete responses and inconsistent exemptions.
The ICO’s public role
The Information Commissioner’s Office is responsible for upholding information rights and promoting compliance with data protection law. Its work sits across data protection, freedom of information, electronic communications, public-sector transparency and wider information governance.
On paper, that sounds like a powerful institutional mandate. The ICO is often perceived as the body that will intervene when organisations withhold personal data, resist transparency or mishandle information. For many complainants, especially whistleblowers, journalists and litigants in person, the expectation is simple: if a data controller blocks access to important information, the ICO will step in.
The practical reality is usually more constrained. The ICO does not operate as a general evidence-gathering service, a litigation disclosure tribunal, or a rapid-response investigator for every disputed document. That gap between public expectation and regulatory reality is where many complaints fail.
A reactive regulator?
The draft criticism is that the ICO can function less like a proactive enforcer and more like a reactive adjudicator of technical compliance. In that model, the complainant is not asking a powerful regulator to uncover the truth; they are asking a regulator to decide whether the organisation has stayed within the boundaries of data protection or information rights law.
That matters because the ICO’s assessment may focus on whether the organisation has given a legally defensible response, not whether the complainant has received every document they believe is relevant to a wider dispute. Where the background is employment litigation, whistleblowing, regulatory misconduct or institutional failure, that difference can feel stark.
What complainants expect
Decisive intervention: pressure on the organisation, disclosure of withheld material, and an independent route to evidence that may support a legal challenge.
What they may receive
Technical assessment: an evaluation of response times, exemptions, scope, search adequacy and whether the controller’s position is arguably compliant.
This does not mean the ICO is irrelevant. It means that complainants need to understand the narrowness of the process before relying on it as the main route to documents.
SARs and legal disputes
Subject Access Requests can be powerful, but they are often misunderstood. A SAR is a route to personal data, not a general right to every document that may help a legal case. That distinction becomes critical when a request is framed openly as an attempt to obtain evidence for proceedings.
Individuals may be entitled to their personal data even where the material is uncomfortable for the organisation. However, organisations may still consider scope, proportionality, exemptions, third-party data, privilege, manifestly unfounded or excessive requests, and restrictions that may apply in particular contexts. The dispute then becomes less about the complainant’s wider grievance and more about whether the data protection response was legally adequate.
That is why SARs can disappoint in litigation-heavy situations. A person may believe they have asked for “the evidence”, while the controller responds as though it has been asked only for personal data within the meaning of data protection law.
Before relying on a SAR, ask these questions
- Am I asking for my personal data, or am I really seeking disclosure of documents for litigation?
- Can I describe the data, timeframe, systems and custodians precisely?
- Have I avoided wording that makes the request look unfocused or excessive?
- Do I need court or tribunal disclosure instead of, or alongside, subject access?
- Have I preserved proof of submission, deadlines, replies and omissions?
The controller advantage
Data controllers usually hold the records, understand their systems and control the first explanation of what has or has not been searched. That gives them a practical advantage, especially where the data subject cannot see what is missing until the response arrives.
Once a request is linked to a legal dispute, the controller may be more likely to scrutinise scope, exemptions, privilege and burden. The ICO may then be asked to assess whether the controller’s response was within the law, rather than to resolve the underlying dispute between the parties.
The result can be frustrating. A complainant may feel that the organisation is withholding the truth, while the regulatory process focuses on narrower questions: was the request answered on time, was the search reasonable, was an exemption explained, and was the refusal properly justified?
The request is made
The data subject seeks information, often hoping to obtain evidence for a grievance, employment dispute, whistleblowing case or regulatory complaint.
The controller narrows the issue
The organisation responds through the language of scope, exemptions, search terms, burden, third-party data and legal privilege.
The ICO assesses compliance
The regulator may look at whether the response was compliant, not whether the complainant has enough evidence to prove a wider legal claim.
What the ICO actually does
The ICO’s remit is broad, but not unlimited. Understanding its core functions helps avoid relying on the wrong route for the wrong problem.
Data protection
Assessment of compliance with UK data protection law, including personal data handling, access rights and some organisational failures.
Complaints and breaches
Consideration of data protection complaints and reported breaches, with outcomes that may range from advice to enforcement action.
Freedom of information
Decision notices and complaint handling where public authorities refuse or mishandle FOI requests.
Surveillance and public-sector data
Oversight and guidance in areas involving CCTV, public authority data use and wider information governance.
Guidance and codes
Publication of guidance, codes and practical expectations for organisations handling personal data and public information.
Electronic communications
Regulation of areas such as nuisance marketing, cookies and electronic communications compliance under PECR.
The challenge is not that the ICO lacks functions. The challenge is that the existence of a remit does not guarantee fast, forceful or individually useful enforcement in every case.
Practical limits
The ICO has real powers, but complainants should be clear about its practical limits. It may not act quickly. It may not treat a case as systemic. It may accept a controller’s explanation where the complainant believes the real problem is deeper. It may give an outcome that helps establish non-compliance, but still leaves the person needing a court, tribunal or regulator to resolve the underlying dispute.
Common frustrations
- Slow complaint-handling where time-sensitive evidence is needed.
- Controller explanations accepted despite suspected gaps.
- Limited practical pressure where disclosure is resisted.
- Outcomes that do not resolve the wider legal dispute.
Common misunderstandings
- Assuming a SAR is the same as litigation disclosure.
- Assuming the ICO will investigate the whole background dispute.
- Assuming FOI applies to private bodies.
- Assuming a regulator complaint will preserve limitation or tribunal deadlines.
How to use the system effectively
The practical answer is not to abandon SARs, FOI requests or ICO complaints. It is to use them precisely. The more procedural, evidenced and focused the complaint, the harder it is for a controller to dismiss it as a generalised dispute.
Frame the request narrowly
Identify the data, date range, system, department, custodian or correspondence type. Avoid sprawling requests that allow the controller to argue burden or lack of clarity.
Track deadlines and proof
Keep the request, submission proof, acknowledgement, deadline, extensions, chaser emails and final response in a single evidence file.
Challenge missing data specifically
Where a response appears incomplete, identify the missing categories and explain why they are expected to exist.
Test exemptions carefully
Ask the controller to identify the exemption or restriction relied upon, explain its application, and confirm whether partial disclosure or redaction was considered.
Use the correct route
Use SARs for personal data, FOI for public authority information, and court or tribunal disclosure where the real need is litigation evidence.
Closing point
The ICO is not useless. But it is often less interventionist, less immediate and less expansive than complainants expect. That matters most where the person seeking information is already under pressure from a legal dispute, whistleblowing conflict or institutional power imbalance.
The lesson is strategic. Do not rely on the ICO as a single route to truth. Build a record, use the correct legal mechanism, keep requests precise, preserve deadlines and challenge procedural failings clearly.
The ICO may be reactive, but a well-prepared complainant does not have to be passive.
Disclaimer
This article is general information and public-interest commentary. It does not constitute legal advice. Data protection, FOI, litigation disclosure, privilege, regulatory complaints and limitation issues are fact-sensitive. Readers should check current ICO guidance, legislation, procedural rules and any applicable court or tribunal orders before acting, and should seek advice from a suitably qualified solicitor or regulated adviser where necessary.
I rang the ICO once, and their attitude was really hostile. They wanted to COLLECT my personal data just to give information out to me about how they operate. Instant breach of the GDPR because data collection must be minimal and only what is necessary to perform a function. Simply telling a random member of the public how their organisation operates, does not require ANY personal data whatsoever. So why did they have this internal culture of trying to collect some regardless? Unlawfully. I had to avoid being triggered. I have PTSD from hacking and stalking which means abuse of personal data is a trigger – sometimes. Such behaviour is exactly the kind of thing my abusers have been known to do. Then gaslight me they never did it. Not a good look, ICO. The Data Protection Act (1984 onwards) has ALWAYS been a sop, a false sense of security designed to enable abusive gathering of intel on the common person. Leading up to today’s age of AI-leveraged Digital (ID) Big Brother. Very bad indeed. Shame on the ICO and all involved in this, Zion-Sturmer included.