Enhancing Transparency in UK Data Subject Access Requests: Overcoming Redaction and Omission Challenges

Why DSARs matter

A Data Subject Access Request, often shortened to DSAR or SAR, is one of the most direct ways a person can understand how an organisation is processing their personal data. It can reveal correspondence, internal notes, account information, decision records, complaint handling, lawful-basis explanations and data-sharing practices.

That makes the right of access especially important where the individual is trying to understand an adverse decision, a dispute, a professional-service file, a workplace process, a property matter, a complaint record or a regulator-facing issue. A weak response does not merely frustrate curiosity. It can prevent the person from understanding the record that has been created about them.

The redaction problem

Redaction is not inherently suspicious. Organisations may need to protect third-party personal data, privileged legal communications, confidential material or information covered by a statutory exemption. The problem arises when redactions are so broad that the response becomes practically unusable.

Where sender fields, recipient fields, dates, subject lines, document context and exemption explanations are removed, the requester may be unable to test whether the redaction is justified. A response can then appear formally compliant while failing the transparency test that makes the right of access meaningful.

The omission problem

Omission is more difficult than redaction because it may leave no visible mark. The data subject may know that a meeting happened, a call took place, a file was opened, a third party was contacted or an internal decision was made, but the response may contain no obvious trace of it.

That is why search explanation matters. A DSAR response is stronger when the controller explains the search logic: which systems were searched, which date range was used, which teams or matter files were considered, whether archived material was checked, and whether any search limits were applied.

The ICO route

The Information Commissioner’s Office is an important route where a data subject considers that a controller has failed to comply with a DSAR. The ICO may consider complaints and, in appropriate cases, use enforcement powers.

But a complaint to the ICO is not the same thing as a full disclosure audit for the individual. The practical difficulty is that many disputes turn on detailed questions: what was searched, what was omitted, whether privilege was correctly applied, whether third-party data could have been partially disclosed, and whether a category explanation would have been possible.

Case study: Naylors Gavin Black

The draft case study concerns a DSAR response involving Naylors Gavin Black. The data subject says the response raised concerns about delay, extensive redaction, vague explanation of withheld material, possible conflicts in the redaction process, and insufficient clarity about third-party data sharing.

Those concerns should be examined as questions requiring evidence rather than assumed findings. The strongest public-interest value is in the pattern: how does a data subject test a response when the controller has legal resources, controls the records, and can rely on exemptions that may be difficult to challenge without seeing the withheld material?

The lesson is broader than one case study. The more contested the underlying relationship, the more important it becomes for the DSAR response to show process discipline.

Better accountability mechanisms

Improving DSAR transparency does not require every withheld document to be disclosed. It requires a better way to explain and test what has happened. The following mechanisms would make contested responses easier to assess.

Practical steps

Data subjects, controllers and policymakers each have a role in improving DSAR transparency. The aim should be a process that is easier to understand, easier to challenge and easier to defend.