Subject access after the Data (Use and Access) Act: reasonable and proportionate searches

What the new wording changes

The starting point remains the right of access, not the convenience of the organisation’s filing system. Article 15 of the UK GDPR gives a person the right to confirmation of whether their personal data is being processed and, where it is, access to that data and supplementary information including the purposes of processing, the categories of data and the recipients or categories of recipient. A request is therefore about more than receiving a bundle of obvious documents.

Section 78 of the Data (Use and Access) Act 2025 inserted Article 15(1A). It provides that the person is entitled to the confirmation, personal data and other information that the controller can provide based on a reasonable and proportionate search; the Act says that this amendment is to be treated as having come into force on 1 January 2024. The wording qualifies the search required to give effect to the right. It does not create a discretion to disclose only what is easiest to retrieve.

The ICO’s updated guidance gives the phrase operational content. A controller must make reasonable efforts to find and retrieve the requested information. In assessing whether a search would be unreasonable or disproportionate, it should consider the circumstances, the volume to be searched, the difficulties involved and the fundamental nature of the right of access. It must be able to show why a search is unreasonable or disproportionate and should still search for other information within the request. Proportionality is consequently a reasoned boundary, not a blanket answer.

The ordinary response period is one month from the relevant starting point. A controller may extend it by two further months where necessary because of the complexity or number of requests, but must give notice within the initial month and state the reasons for delay. The ICO also says that a large volume of information may add to complexity but does not automatically make a request complex. Volume alone should therefore not be treated as a self-explanatory reason for an extension. Nor does it remove the requirement to make reasonable efforts to find and retrieve requested information.

Build a searchable request

If you need a grievance file, a sequence of decisions or particular account records, practical detail can reduce the risk of a missed search. Describe the records you have reason to believe exist and how they can be found, rather than guessing the organisation’s entire information architecture.

Separate your priority material from any wider remainder. For example, you might ask for the complete complaint file between two dates as the first category, then request other personal data as a second category. That gives the organisation a clear order of work without silently abandoning the broader request.

Do not list systems speculatively and then treat their absence from the response as proof of concealment. Ask the organisation to identify any other obvious repository within the described context. Equally, being copied into an email does not necessarily make the whole email your personal data. ICO guidance explains that the right applies to the personal information in an email that relates to the requester; only part of an email may need to be disclosed, while content that relates to the requester must be provided, with redaction where necessary. Precise search terms are useful, but they are not a substitute for assessing content.

Answer clarification without losing scope

Clarification can be genuinely useful. Under Article 12A, where a controller reasonably requires further information to identify the information or processing activities covered by an Article 15 request, it may ask for that information. The period from the day it asks to the day it receives the answer does not count towards the response period. That pause makes the wording and timing of both sides’ messages important.

It is not a universal pause whenever an organisation asks a question. The ICO says clarification should not be sought on a blanket basis, a question about the format of the response does not stop the clock, and a person cannot be forced to narrow a request. If the person repeats the request or declines to add detail, the organisation should still comply by making reasonable searches.

Respond promptly and in writing. Distinguish “these are my priorities” from “I am withdrawing everything else”. If you want to preserve the wider scope, say so expressly: “The dates and identifiers above clarify my priority records. I maintain the remainder of my original request. Please make reasonable and proportionate searches for that remainder.” Ask the organisation to confirm the original receipt date, the date clarification was requested, the date your response was received and the revised due date. That is timetable housekeeping, not hostility.

Identity checking is a separate issue. Article 12(6) allows a controller with reasonable doubts about identity to request additional information necessary to confirm it and to delay dealing with the request until identity is confirmed. A question genuinely about identity should not be confused with an attempt to reopen the subject matter or narrow the records requested.

Test the response and its limits

A useful response should be read against the request category by category. Look for date gaps, an unnamed system you specifically identified, missing attachments referred to in disclosed emails, or a phrase such as “not readily accessible” with no further explanation. Those are prompts for a focused follow-up, not automatic proof that a legal breach has occurred.

Archived material deserves particular attention. The ICO says there is no technology exemption from the right of access: organisations should have procedures to find and retrieve electronically archived or backed-up personal information and should use the same effort as they would use to retrieve it for their own purposes. Deleted information is different: the ICO does not require extreme measures to recreate electronic information genuinely deleted through general records management. Ask which situation applies instead of assuming that “archive”, “backup” and “deleted” are interchangeable labels.

Disclosure may also be limited for reasons other than search scope. Article 15(4) says that the right to obtain a copy must not adversely affect the rights and freedoms of others. Part 2 of the Data Protection Act 2018, together with its schedules, provides exemptions, restrictions and adaptations that can apply to Article 15. A redaction or withholding decision should therefore be examined on its own stated basis rather than treated as evidence that no search took place.

If the organisation relies on proportionality, ask it to identify which proposed search it considers unreasonable or disproportionate, which systems or categories that affects, what efforts it made for the remainder, and whether a narrower technical search would resolve the difficulty. This is a practical request for an explanation focused on the systems and categories in dispute.

Preserve a record for a complaint

Build the record while the chronology is fresh. Keep the request exactly as sent, proof of transmission, identity or authority correspondence, every clarification and answer, the covering response and the disclosed files. Record the original and revised due dates. After a call, make a dated note of who spoke and what was said. Preserve the disclosed files as received, separately from any working copies you annotate.

Then make a short missing-records schedule. For each item, identify the document or category, why you believe it exists, the search you requested, what the response says and the question that remains. A disclosed email referring to an absent attachment, a known reference number or an unexplained gap in a continuous sequence is more useful than a general assertion that the organisation “must have more”. Keep the distinction between something you know, something you infer and something you are asking the organisation to check.

The ICO advises someone unhappy with a subject access response to complain to the organisation first, clearly list the information they think is missing and keep copies of correspondence and notes of calls or meetings. For complaints received on or after 19 June 2026, section 164A of the Data Protection Act 2018 requires the controller to acknowledge the complaint within 30 days, take appropriate steps to respond without undue delay and inform the complainant of the outcome; appropriate steps include enquiries and progress information. A focused complaint gives that process something concrete to examine.

If the matter remains unresolved, the same file supports an ICO complaint. The ICO asks complainants to raise the complaint within three months of their last meaningful contact with the organisation and to provide the key documents. It cannot act as the complainant’s representative or award compensation. Set out the search issue first: what was requested, what appears to be missing, why you believe a further reasonable search is possible and how the organisation answered that proposal. That is more disciplined than asking the ICO to infer a search failure from disappointment alone.