Home / Data Subject Access Requests (DSARs) without the panic
16th October 2026
Laura Crowe, Senior Associate
Subject access requests (DSARs) continue to present challenges for HR, compliance, legal and operational teams. While the legal framework remains unchanged, organisations are increasingly facing requests that are broader, more detailed and more resource-intensive to manage.
One factor driving this trend is the accessibility of generative AI. Individuals can now use AI tools to draft sophisticated DSARs which reference data protection legislation, request multiple categories of information, and seek extensive disclosures. While this can help individuals exercise their rights, it can also create significant practical challenges for organisations seeking to identify the true scope of a request and respond efficiently within statutory timeframes.
Early engagement with the requestor can help clarify what personal data is being sought. This is particularly important where AI-generated requests contain lengthy lists of questions or information requests that extend beyond the right of access itself.
By narrowing the focus to relevant time periods, systems, business functions or issues, organisations can often reduce the burden of compliance while ensuring they meet their UK GDPR obligations.
An employee submits a six-page DSAR generated using an AI tool. The request seeks “all personal data”, copies of every email that mentions them, details of any complaints, performance discussions, internal communications, and information relating to decision-making processes spanning a five-year period.
Rather than immediately conducting organisation-wide searches, the employer engages with the individual to clarify the scope of the request. Through this discussion, it becomes apparent that the employee’s concerns relate primarily to a recent performance review and promotion decision.
By focusing searches on the relevant period, custodians and systems, the organisation can identify and review the personal data most likely to be relevant to the request. This approach reduces the burden on internal teams while remaining consistent with the organisation’s obligations under the UK GDPR.
The key lesson is that a lengthy or legally sophisticated request does not necessarily require limitless searching. Early engagement and proportionate scoping can help both the organisation and the individual achieve a more efficient outcome.
DSARs often require input from multiple teams. HR, IT, compliance, and legal departments may all hold relevant information or play a role in reviewing disclosures.
Identifying a lead coordinator, allocating responsibilities, and setting internal deadlines can help avoid duplication, maintain momentum, and ensure accountability throughout the process.
A common challenge with AI-generated DSARs is the perception that every system and repository must be searched. However, organisations are generally expected to undertake searches that are reasonable and proportionate in the circumstances.
Searches should be guided by the nature of the request, the likely locations of personal data and the outcome of any scoping discussions. Being able to justify the methodology is often more important than conducting exhaustive searches of every possible source. Keeping records of decisions made whilst assessing and responding to DSARs is therefore key.
The most effective DSAR responses are usually built on strong data governance. Up-to-date data maps, records of processing activities, retention schedules and established response procedures can significantly reduce the time and effort required to locate and review personal data.
Training staff to recognise the distinction between a request for personal data and broader information requests can also help organisations manage increasingly sophisticated DSARs effectively.
Generative AI is making it easier for individuals to submit detailed and professionally drafted DSARs. As a result, organisations may see an increase in both the volume and complexity of requests.
Clear scoping, defined ownership, and proportionate searches remain the foundations of an effective response. By adopting a structured approach, organisations can manage DSARs more efficiently while continuing to meet their obligations under the UK GDPR.
If your organisation requires advice or assistance with any of the above, including training, please contact Laura Crowe CIPP/E in our commercial team who will be happy to help.