Subject Access Requests and AI – working against and for you

AI is changing the subject access request (DSAR) process. Individuals now frequently use generative AI tools to produce lengthy requests in minutes. At the same time, charities can use AI-assisted technology to help search, review and redact the potentially significant volumes of information caught by DSARs.

For charities who may have limited internal resources, this creates both a challenge and an opportunity. DSARs may come from employees, former employees, volunteers or other individuals, and can require searches across emails, Microsoft Teams messages, HR systems, shared drives and other locations.

The key is preparation. Charities who understand where their personal data sits, have reasonable retention periods and have an established DSAR process will be much better placed to respond.

AI is making it easier to submit DSARs

AI-assisted requests are becoming increasingly prevalent. AI allows individuals to prepare detailed DSARs without necessarily understanding the extent of the right of access or the information to which they are actually entitled.

This can result in requests which:

• seek information falling outside the DSAR scope;
• contain excessive or unnecessary detail;
• cite legislation or regulatory guidance that is not relevant or accurate;
• request broad categories of information with little connection to the individual’s actual dealings with the charity; or
• use generic or formulaic wording which has not been tailored to the individual’s circumstances.

More generally, increasing awareness of data protection rights means charities should expect individuals to be increasingly confident in exercising their right of access.

However, whether AI has been used to draft a request is ultimately beside the point. The focus is on the substance of a request; an AI-generated request is still valid if the substance of the request is to access the individual’s personal data.

Why can DSARs be particularly difficult for charities?

A DSAR does not have to come from a customer or employee. Volunteers and former volunteers can make DSARs too, as can any other individual whose personal data the charity processes.

On receipt of a DSAR, the charity needs to scope and carry out searches for the individual’s personal data, review the results of those searches for relevance, establish whether any exemptions apply, consider what information concerning third parties should be withheld or redacted, and compile the required additional information to accompany the response.

For charities operating with relatively small internal teams, that can put considerable pressure on already limited resources.

Nevertheless, the Information Commission confirms in its guidance that charities should ensure that information management systems are well designed so that you can efficiently locate and extract requested information. Limited resources or unsophisticated systems do not reduce the obligation to carry out a reasonable and proportionate search.

Practical steps to make DSAR compliance easier

1-Plan before you receive a request

Charities should not wait until a DSAR arrives to establish where personal data is held.

Charities should:

• catalogue the systems containing personal data;
• understand what categories of data those systems contain;
• identify the people responsible for conducting searches;
• establish appropriate retention periods and deletion processes;
• train staff and volunteers to recognise a DSAR and know where it should be referred; and
• maintain a clear internal process for escalating and responding to requests.

2- Engage constructively with the requester

Where a DSAR is broad or unclear, constructive communication with the requester may help establish what information they are actually seeking.

This can significantly reduce unnecessary searching and focus resources on the information that matters to the individual, such as information they have not previously seen.

3-Consider what searches are reasonable and proportionate

Charities must undertake reasonable and proportionate searches, which does not mean searching every location.

The Information Commission says relevant factors include the volume of information, difficulties in locating it and the circumstances of the request. Crucially, the charity needs to be able to justify why it considers a search unreasonable or disproportionate.

That assessment should be documented and, for particularly extensive or contentious DSARs, legal advice may be appropriate.

4- Do not delete information

Established retention processes remain important, and charities should not retain personal data indefinitely. However, once a DSAR has been received, charities must not delete potentially relevant information.

5- Document your decision-making

Maintain a clear audit trail recording matters such as:

• systems searched;
• search terms and parameters used;
• decisions about the scope of searches;
• relevant exemptions;
• decisions concerning third-party information;
• redactions; and
• reasons for withholding information.

This can be particularly important if the requester challenges the response or subsequently complains to the Information Commission.

6- Protect other people’s rights

A DSAR does not automatically entitle the requester to receive personal data about colleagues, volunteers, beneficiaries or other third parties.

Information concerning other individuals may therefore need careful review and, where appropriate, redaction before disclosure.

7- Assume your correspondence may become part of a future request

Keep internal and external communications professional, factual and proportionate throughout the process in case there are potential follow-up DSARs.

8- Don’t forget the rest of the response

Providing copies of personal data is only part of DSAR compliance. The response must also provide the supplementary information required by data protection law and should clearly explain where information has been withheld or an exemption relied on.

Can AI make responding to DSARs easier?

The same technology that can increase the volume and complexity of DSARs can also make responding to them significantly more efficient, especially where a DSAR involves thousands of documents.

Subject to appropriate human oversight, AI-assisted tools may help charities:

• search large datasets;
• identify potentially relevant documents for review;
• identify duplicate materials;
• identify personal data;
• carry out redactions;
• summarise lengthy email chains or documents;
• prepare draft correspondence; and
• maintain an audit trail of the review.

AI should assist rather than replace human judgement. Potential risks include AI:

• overlooking relevant documents;
• identifying information as personal data when it is not, or vice versa;
• applying redactions incorrectly; and
• producing inaccurate conclusions about whether a legal exemption applies.

Sensitive personal data should also not be uploaded into publicly accessible AI tools.

How we can help

Good DSAR management starts before a charity receives a DSAR.

Cripps can support charities at all stages of a DSAR. We can support with scoping searches, reviewing and redacting documents, applying exemptions and managing correspondence with the requester by using our Cripps DSAR Solution technology to make large-scale reviews more efficient.

If you would like support, get in touch with our team.