Published by Alisha McKerron on 22 October 2026

Dealing with data subject requests can be overwhelming. More so in an AI environment when potentially they can arrive in bulk, are lengthy and wide reaching, and/or where organisations do not have effective tools/ manpower at their disposal to properly query its information. They can be anxiety inducing as well; the maximum fine for breach under UK GDPR being 17.5mil. or 4% of annual global turnover.

But there is nothing that a systematic approach cannot solve.There is also no need to be overly anxious about fines in the UK. For standalone DSAR non-compliance, UK ICO is using enforcement notices, reprimands, and statutory orders rather than financial penalties. That’s not to say one should be complacent, particularly if you conduct business in the EU. EU non-compliance can attract fines of €5,000 to €250,000. The largest GDPR fines overall — such as Meta (€1.2 Billion, 2023) or TikTok (€530 Million, 2025) — bundled in DSAR non-compliance.

To help you navigate these requests calmly and efficiently, I’ve distilled key regulatory expectations into a set of practical Do’s and Don’ts below. (For those who want to dive deeper into the legal sources¹ there are detailed footnotes at the end!)

Do:

• train staff to know what personal data² is
• train staff to know what a DSAR³ is
• ensure that staff know who to pass DSARS onto so that they can be dealt with promptly
• be able to query⁴ your information to find all the information you hold about an individual
• encourage data subjects to submit requests via an online form⁵
• automate responses and implement self-service portals to lessen the burden⁶
• acknowledge the request without undue delay⁷ in writing in the same format⁸ as used for the request
• record the statutory deadline and verify when the request was received
• consider whether the request is valid⁹ and whether identity needs verification (if necessary)¹⁰.
• clarify¹¹ the scope of the request, if reasonably required, or refrain from doing so
• go through what has been requested¹²
• prohibit staff from holding information about customers, contacts or other employees on their personal devices
• locate data under your control¹³ and allocate responsibilities¹⁴
• searches as soon as possible¹⁵
• limit search to what is reasonable and proportionate¹⁶
• use statutory deadline extension¹⁷ for requests that are complex¹⁸
• inform data subject of your reliance of the extension, with reasons, within a month of receiving the DSAR¹⁹
• refuse request/ charge²⁰ a fee if manifestly unfounded²¹or excessive²² within a month of receiving the DSAR
• inform employee why request was manifestly unfounded or excessive²³
• if possible, upload data to e-Discovery for DSARS over 500 documents²⁴
• redact personal data of another if you cannot rely on an exception²⁵
• rely on exemptions²⁶
• maintain records²⁷ explaining why decisions were made
• provide extracted personal data in a clear intelligible summary or transcript²⁸ or copies of personal data with redactions
• provide copies of documents that can be disclosed in full²⁹
• provide the data responsibly³⁰
• craft a robust outcome, to their complaint, if they go on to complain
• direct them swiftly to the ICO, if they still pick seemingly trivial holes

Don’t

• ignore a DSARs and breach GDP³¹
• delete, destroy, alter or conceal certain information with the intention of preventing disclosure³²
• ask for reasons why the DSAR is being made
• provide information which contains personal data of another individual unless an exception applies³³
• let the senders or recipients of emails that are subject to review redact/extract their emails³⁴.
• ask for clarification on a blanket basis/ misuse clarification³⁵
• give point to point answers to every single matter they have raised
• provide confidential information
• provide data that is covered by legal and professional privilege³⁶
• provide a reference given/ received in confidence ³⁷
• provide information used for management forecasting / planning³⁸
• provide any information setting our intention in relation to negotiations with requester³⁹