My Battle for UK GDPR Compliance: Challenging Muckle LLP’s Handling of Subject Access Requests

Why this matters

A Subject Access Request, often shortened to SAR, is one of the most practical rights in UK data protection law. It allows a person to ask what personal data is being processed, obtain a copy of that data, and receive supplementary information about how it is being used.

That right matters especially where the data sits inside legal correspondence, matter files, complaint handling, internal emails, advice notes, call records, decision documents or communications between professional firms. A response may be formally lengthy but still difficult to test if key context is withheld or if exemption explanations are too general.

Case background

The complainant says their SAR experience with Muckle LLP raised concerns about how legal-sector organisations handle data access requests when the underlying matter is contested. The concerns included whether correspondence had been withheld, whether redactions were properly explained, whether legal professional privilege had been applied too broadly, and whether the search had covered all likely sources of personal data.

The complainant also says there were similarities between SAR responses from two organisations, raising a question about whether Muckle LLP had a wider role in drafting or shaping another response. Similarity of wording does not prove improper coordination. It may reflect template wording, shared legal language or ordinary professional input. But where the requester’s personal data may have been shared or discussed, it is reasonable to ask what role each organisation played and what data was processed.

Redactions and privilege

The complainant says the response relied on legal professional privilege to withhold significant material. Legal professional privilege can be a valid reason for withholding personal data in a SAR response. It protects confidential legal communications in defined circumstances, including legal advice privilege and litigation privilege.

The concern in this case study is not that privileged material must always be disclosed. The concern is whether the explanation was specific enough to allow the data subject to understand the categories of material withheld and why privilege was said to apply. A response that simply invokes privilege without meaningful context can leave the requester unable to test whether the exemption has been applied to the facts of the request.

Legitimate interests and transparency

The complainant says they asked for more information about the legitimate interests relied on in the processing of their personal data and were told there was no legal obligation to provide the legitimate interest assessment itself. That issue needs careful separation.

A controller may not always be required to disclose an internal assessment document in full. However, where legitimate interests are relied on as a lawful basis, transparency still matters. A data subject should be able to understand the purpose of processing, the nature of the interest relied on, and how their rights and interests have been considered.

Search scope and security information

The complainant says the initial response appeared to limit the search to emails and matter files. That raised a concern about whether other sources of personal data had been considered. In many organisations, personal data may sit across case-management systems, billing records, call notes, internal messaging, archived files, document-management systems, complaints records and correspondence with third parties.

A SAR response is stronger when it explains the search logic. The requester does not need every internal operational detail, but they should be able to understand whether the organisation looked in the obvious places and whether any limitation on search scope was reasonable.

The complainant also says the firm referred to privacy-policy and third-party compliance material when asked about security measures. In data protection practice, security is not only a policy statement. It includes technical and organisational measures appropriate to the risk. A response does not have to disclose sensitive security detail that could create risk, but it should give enough information to explain how personal data is protected at a meaningful level.

Tone and accountability

The complainant says that when they raised concerns about possible public disclosure of their experience, the response characterised this as a threat and as akin to blackmail under section 21 of the Theft Act 1968. That is a serious characterisation. In a data-rights dispute, language of that kind can change the whole tone of the exchange.

There is an important difference between improper pressure and a person saying that they may speak publicly about a regulatory or rights-based concern. Organisations are entitled to protect their position, challenge unfair allegations and object to improper conduct. But professional engagement is stronger when it addresses the substance of the concern before escalating the language of the dispute.

Practical lessons

This case study points to practical lessons for organisations handling SARs and for data subjects challenging responses. The best SAR process is not simply legally defensive. It is structured, intelligible and capable of being checked.