Written by Data protection case commentary
Subject access requests are meant to give people practical access to their personal data. But where a response is delayed, heavily redacted, unclear about exemptions, or appears to omit known documents, the right of access becomes difficult to test. This case study examines concerns raised about a SAR response involving Naylors Gavin Black LLP and Angus White, and asks what a transparent, accountable process should show.
Publication snapshot
- The supplied account concerns a SAR made to Naylors Gavin Black LLP on 4 April 2024 and a final response said to have been received on 28 June 2024.
- The concerns include response timing, redactions, exemption wording, alleged omission of known material, third-party sharing clarity and independence of review.
- Naylors Gavin Black LLP is said to have maintained that it had provided the required information and complied with its obligations.
- The article does not treat those concerns as findings of breach. It uses them as a practical case study in how SAR disputes become hard to test.
- The broader lesson is that controllers should be able to explain search scope, redaction categories, exemption basis, third-party data handling and escalation routes clearly.
Why this matters
Data protection rights matter most when the underlying relationship is already disputed. A SAR may be used to understand what a firm recorded, who received personal data, what decisions were made, what third parties were involved, and whether the data subject’s position was accurately reflected.
In the legal and property sectors, those questions can become especially sensitive. Files may contain client communications, legal advice, third-party personal data, property management records, tenant communications, dispute notes and commercially sensitive material. Some of that information may properly be withheld or redacted. The accountability problem arises where the data subject cannot understand enough about the response to test it.
The practical point: a SAR response should not require the data subject to guess what was searched, what was withheld, why it was withheld, or whether known documents were omitted.
Timeline of key events
The supplied account gives the following chronology. It should be treated as the complainant’s chronology unless and until supported by primary correspondence or an external finding.
Initial SAR submitted
A subject access request is said to have been submitted to Naylors Gavin Black LLP.
Partial response
The firm is said to have provided a partial response. The requester says further clarification or guidance on SAR handling was then required.
Final SAR response
A final response is said to have been delivered. Clarifications were sought the same day.
No further correspondence position
Naylors Gavin Black LLP is said to have indicated that it would not correspond further on the matter.
Position reaffirmed
Two further communications are said to have reaffirmed the firm’s position.
Draft article sent for comment
The draft article is said to have been sent to the firm, giving an opportunity to comment or clarify.
Final communication
The firm is said to have maintained its position.
The core SAR concerns
The concerns raised in the supplied account fall into familiar SAR-dispute categories: timing, redaction, exemption justification, search scope, third-party data handling and confidence in the review process.
Response timing
The requester says the full response was not received until nearly three months after the original request. The key question is whether any lawful extension, clarification pause, identity issue or complexity explanation was relied on and communicated properly.
Redactions
The response is said to have contained heavy redactions. Redaction may be lawful, but the controller should be able to explain the relevant exemption category where possible.
Withholding reasons
The requester says explanations for withholding information lacked specificity. The practical issue is whether the response gave enough information to understand and challenge the refusal.
Independence of review
The supplied account raises concern that people connected with the underlying dispute may have influenced disclosure decisions. The process question is whether sensitive SARs should be reviewed by someone sufficiently independent of the dispute.
Third-party sharing
Questions are raised about what information was shared with third parties and how that was explained. Transparency about recipients and processing context is often central to the value of a SAR.
Data accuracy
The requester links the concerns to data accuracy and completeness. The practical question is whether the disclosed record accurately reflects the data subject and the relevant events.
Missing material and search scope
The supplied account identifies an email dated 18 October 2023 which is said to have been absent from the SAR response. It also refers to a partially redacted email dated 17 November 2023 between solicitors and Naylors Gavin Black, said to raise further questions about the property, third-party involvement and the complainant’s planned collection of belongings and possible legal relief.
Those points matter because omission is harder to test than redaction. A redaction is visible. An omitted document may only be identifiable if the requester already knows it exists. That makes the controller’s search explanation important: systems searched, date ranges, custodians, file locations, archived material, email accounts and any limits applied.
Known missing item
Identify the date, sender, recipient, subject matter and why the document is expected to contain personal data.
Search locations
Ask which files, email accounts, matter records, archived systems and third-party correspondence were searched.
Exemption basis
Separate legal professional privilege, third-party personal data, confidentiality and other exemptions rather than using a single generic withholding explanation.
Partial disclosure
Where full disclosure is refused, consider whether contextual information, dates, categories or limited extracts can still be provided lawfully.
The firm’s position
The supplied account states that Naylors Gavin Black LLP maintained that it had provided all required information and complied with its obligations. That position matters. It means the case should be framed as a disputed SAR transparency concern, not as an established breach.
The public-interest value lies in the accountability question: when a data subject says the response is late, incomplete, over-redacted or insufficiently explained, what should a controller be able to show to demonstrate that the response was reasonable, proportionate and compliant?
The key distinction
The article does not ask readers to assume that the firm breached UK GDPR. It asks what evidence a fair SAR process should leave behind when the data subject disputes timing, search scope, redaction and third-party sharing.
Sector lessons
The case study has wider relevance because professional firms often hold layered data. Property files may involve landlords, tenants, agents, surveyors, neighbouring businesses, solicitors, contractors and internal decision-makers. Legal and professional-service files may also contain privilege, confidentiality and third-party data issues.
That complexity is not a reason for weak transparency. It is a reason for better process. A controller handling a sensitive SAR should be able to show that it understood the request, searched proportionately, reviewed exemptions carefully, explained withholding where possible, and kept an audit trail.
SAR handling protocol
Clear internal steps for recognition, logging, identity checks, search planning, review, redaction and response.
Search record
A record of systems searched, custodians checked, date ranges used, archived material considered and any limits applied.
Redaction schedule
A category-level explanation of withheld material and the exemption or third-party concern relied on.
Independent review
Sensitive or disputed requests should, where practicable, be reviewed by someone not directly involved in the underlying dispute.
Constructive escalation
Where a requester identifies missing material, the controller should answer the specific point rather than rely only on a general statement of compliance.
The practical transparency test
A useful way to assess a contested SAR response is to ask whether the response can withstand basic process questions. The issue is not whether the data subject receives every document they hoped for. The issue is whether the decision-making process is visible enough to test.
Timing
Ask: when was the SAR received, when was identity confirmed, was any clarification sought, and was any extension explained within time?
Search
Ask: which systems, files, inboxes, date ranges and third-party communications were searched?
Exemptions
Ask: which exemption was relied on, why did it apply, and could partial disclosure still be made?
Follow-up
Ask: did the controller engage with specific missing-document concerns or only restate its position generally?
Source anchors
These sources help readers separate the right of access, timing, search scope, exemptions and professional standards:
- ICO: Right of access guidance — current detailed guidance on subject access requests.
- ICO: Responding to a SAR — guidance on one-month time limits, extensions, clarification and fees.
- ICO: Finding and retrieving relevant information — guidance on reasonable and proportionate searches.
- ICO: SAR exemptions — guidance on exemptions, case-by-case analysis, legal professional privilege and reasons for refusal.
- SRA Code of Conduct for Solicitors, RELs, RFLs and RSLs — professional standards relevant to fair dealing, misleading conduct and properly accountable practice.
Closing point
The Naylors Gavin Black / Angus White case study is ultimately about more than one SAR. It illustrates a practical problem in data protection: a data subject may be told that a response is compliant while still being unable to test the searches, redactions, omissions and third-party processing behind it. A stronger system would leave less to trust and more to process evidence.
Legal Lens decision support
Concerned about a redacted or incomplete SAR response?
If a SAR response is late, heavily redacted, unclear about exemptions, or appears to omit known documents, the next step should be structured. A focused review can turn a broad concern into a clear issue map.
What the assessment can organise
Legal Lens can help map the SAR request, response timeline, missing records, redaction patterns, exemption wording, third-party sharing questions and escalation options.
Best for
Data subjects facing delayed responses, heavy redactions, vague exemption wording or suspected missing material.
What you get
A structured issue map showing what is documented, what is disputed, what needs clarification and what evidence supports follow-up.
Practical output
A cleaner route for response: targeted questions, document schedule, ICO complaint structure or correspondence plan.
Independent Legal Lens consultancy. A preliminary assessment is decision support designed to help you organise the documents, issues and next step.