Right to Access Redaction Service...

The DUAA aligns the UK GDPR’s subject access provisions with existing guidance from the Information Commissioner’s Office (ICO). It formalises the “stop the clock” mechanism, allowing controllers to pause the response timeframe when additional information is needed from the data subject or to verify their identity.

In addition, the DUAA clarifies that controllers are only required to conduct a “reasonable and proportionate” search for information and personal data when responding to a subject access request. This reflects current case law, although the legislation does not define what constitutes a “reasonable and proportionate” search.

Notably, the DUAA does not adopt the DPDI Bill’s proposal to permit controllers to refuse subject access requests on the grounds of vexatiousness. Controllers must still demonstrate that a request is manifestly unfounded or excessive to justify refusal.

They also state ‘you should make reasonable efforts to find and retrieve the requested information. However, you are not required to conduct searches that would be unreasonable or disproportionate to the importance of providing access to the information. To determine whether searches may be unreasonable or disproportionate, you must consider:

• the circumstances of the request;
• any difficulties involved in finding the information; and
• the fundamental nature of the right of access.

The burden of proof is on you to be able to justify why a search is unreasonable or disproportionate.

Even where searching for certain information may be unreasonable or disproportionate, you must still search for any other information within the scope of a request. You should also consider whether further information from the individual will help you find the information they have requested.

The ICO state ‘Most of the time, you should avoid disclosing information about other people. But there may be occasions when the personal data you’ve pulled together includes information that’s closely linked to someone else. In those situations, your aim should still be to release the personal data requested. But you also need to think about what might happen if you disclose data about someone else.

First, you should check to see if you need the other person’s consent to provide their information. If you don’t have the consent of the other person, then you should think about whether it’s reasonable to provide that information without their consent. You need to bear in mind any duty of confidentiality you have to them. You also need to think about what kind of information might be disclosed, as some information might be particularly sensitive. If you can’t get consent and it’s not reasonable to provide the information without it, then you should see if you can redact the other persons information.  You should look to disclose personal data if you can but it’s a balancing act in these circumstances.

The ICO state ‘The organisation you’re dealing with must respond as quickly as possible. This must be no later than one calendar month, starting from the day they receive the request. If the organisation needs something from you to be able to deal with your request (eg ID documents), the time limit will begin once they have received this.

If your request is complex or you make more than one, the response time may be a maximum of three calendar months, starting from the day of receipt.’

• Expertise: Third-party providers specialise in handling subject access requests (SARs), ensuring compliance with privacy regulations (e.g., GDPR, CCPA).
• Efficiency: Outsourcing reduces the time and resources needed by internal teams, enabling quicker responses to requests.
• Cost Savings: Outsourcing can be more cost-effective than hiring and training in-house staff, especially for periodic or fluctuating SAR volumes.
• Scalability: External service providers can handle large volumes of requests during peak times, offering flexibility.
• Risk Mitigation: Third-party vendors such as Content Capture Services can help reduce the risk of non-compliance or mishandling of sensitive data, with established processes in place.
• Focus on Core Business: Delegating SAR processing allows internal teams to focus on core business functions, improving overall productivity.
• Data Security: Professional SAR handling services implement stringent data protection measures to ensure the confidentiality and security of personal data.

Individuals have a legal right under UK GDPR, the Data Protection Act 2018, and the new Data (Use and Access) Act 2025 to know what personal data organisations hold about them. This Right to Access entitles them to request confirmation of whether their data is being processed, access to that data, and key information about how it’s used. For organisations, responding to these requests is not just about handing over files—it requires carefully reviewing, preparing, and redacting disclosures to ensure compliance while protecting sensitive third-party information.

A Subject Access Request (SAR) is the formal mechanism through which individuals exercise their Right to Access. While the terms are often used interchangeably, the distinction is important: the Right to Access is the overarching entitlement, and a SAR is the specific process that triggers your organisation’s legal obligation to respond. At CCS, we specialise in managing this entire process—from intake to final redaction—ensuring your disclosures are accurate, defensible, and fully compliant with the latest legislation and ICO guidelines.