Summary
- Employees possess a statutory right to make a data subject access request (DSAR). When an employee submits a DSAR, employers are under a duty to comply and provide the employee with a copy of the personal data requested.
- The circumstances in which an employee can refuse to comply with a DSAR are very limited in practice.
- While employees are under no duty to conduct a search for personal data if doing so would be unreasonable or disproportionate, a DSAR requiring extensive searching will not automatically relieve the employer of their search obligations.
Introduction
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA), individuals possess a right to submit a DSAR. This right relates to ‘personal data’, defined as any information relating to an identified or identifiable living individual.
When an employee exercises this right, the employer (acting as the data controller) is under a duty to comply and provide a copy of the requested personal data. However, for long-standing employees, relevant information may span thousands of emails, chat logs, and internal records. Consequently, responding to a DSAR can quickly escalate into a costly and time-consuming task.
This article explores the duty placed on employers when responding to high-volume DSARs, discussing manifestly excessive requests, the meaning of a ‘reasonable and proportionate search’, and the recent case of Ashley v HMRC [2025] EWHC 134 (KB).
DSARs generally
When an employee makes a DSAR, they are entitled to confirmation as to whether their personal data is being processed, along with a copy of that data. Furthermore, controllers must disclose supplementary information, such as the purposes for processing, the categories of personal data concerned, and any recipients or categories of recipients to whom the data has been or will be disclosed.
Can Employers Refuse to Comply with a DSAR?
There are limited scenarios in which an employer can refuse to comply with a DSAR. Employers facing the task of reviewing extensive data repositories may seek to resist compliance by demonstrating that a request is ‘manifestly unfounded or excessive’.
However, employers must exercise caution before doing so. Employers retain the right to escalate complaints to the Information Commissioner’s Office (ICO) or apply to the court, meaning any refusal to act must be defensible.
Manifestly Unfounded DSARs
Manifestly unfounded applies to a situation where it is clear that the data subject has no intention of actually exercising the right or the request is malicious in nature.
An example of the former would be a situation where someone offers to withdraw their request in return for payment or some other benefit. An example of the latter would be where the request is being used to harass someone or otherwise target them.
Manifestly Excessive DSARs
The ICO Access Guidance states that, when determining whether a request is manifestly excessive, employers should consider whether the request is clearly or obviously unreasonable. In doing so, an employer needs to take account of all the circumstances, including the nature of the requested information, whether the request is proportionate when balanced against the burden or costs involved in responding to it, and whether a refusal may cause substantive damage to the employee.
Is a Request for a Large Amount of Information Manifestly Excessive?
In most cases, no. While proportionality, and therefore the employer’s available resources, is a relevant consideration, the ICO explicitly states that a DSAR is not necessarily excessive simply because an employee requests a large amount of information. Instead, where an employee requests a large amount of information, the Access Guidance recommends clarifying the search with the data subject and considering whether a reasonable search can be carried out for the information.
Therefore, while a large request made to an employer with limited resources may be manifestly excessive, it is unlikely, in itself, to provide sufficient justification for refusing the request without other relevant circumstances, such as multiple DSARs being made.
The Search for Personal Data in response to a DSAR
Rather than removing the obligation to comply with a DSAR by demonstrating that a request is manifestly excessive, an employer may seek to narrow the administrative burden of responding to a DSAR by showing that specific searches for personal data would be unreasonable or disproportionate.
‘Reasonable and Proportionate’
The Data (Use and Access) Act 2025 (DUA Act) amended the right of access to personal data under the UK GDPR, limiting an employee’s entitlement to data that an employer is ‘able to provide based on a reasonable and proportionate search’. Consequently, where searching for certain information is unreasonable or disproportionate to the importance of providing access, the employer is relieved of the duty to conduct that search.
In determining whether a search crosses this threshold, the Access Guidance suggests that employers consider the circumstances of the request, the volume of information requiring review, difficulties in finding the information, and the fundamental nature of the access right. As with manifestly excessive requests, the burden remains on the employer to demonstrate that a search is unreasonable or disproportionate.
The Threshold in Practice
Initially, this may appear to offer a way to limit the time spent handling DSARs. However, an examination of the Access Guidance, particularly regarding emails, reveals that the threshold required to render a search disproportionate or unreasonable remains high.
In the context of email correspondence, the Access Guidance illustrates this using the example of an employee copied into 2,000 emails. If those communications contain nothing more than the employee’s name and email address, it is sufficient to inform the individual of the number of emails in which their data was identified, requiring only a limited search. However, it is further stated that ‘if any of the content within any of the emails relates to the employee, you must provide them with a copy of those particular emails.’ This indicates that a substantive review of the 2,000 emails must still be completed.
As a result, should a DSAR necessitate a search through thousands of emails, the volume of emails is unlikely to render the search disproportionate or unreasonable. Rather, employers are expected to utilise search and filtering tools to manage and scope the search. Therefore, the purchase of a search tool where in-built search tools are insufficient will be necessary. Personal examination of emails flagged as containing personal data after use of a search tool will also be required to ensure that all data is provided to the employee.
Ashley v HMRC [2025] EWHC 134 (KB)
Ashley is significant as it is one of the rare instances in which a court has ruled on how a controller is to respond to a DSAR, providing valuable insight for controllers handling DSARs.
Background
HMRC conducted an enquiry into Michael Ashley between 2014 and 2016 concerning valuations of his properties. In 2022, Mr Ashley submitted a DSAR relating to that enquiry, requesting ‘all information held in relation to him’. HMRC responded by providing Mr Ashley with limited schedules containing heavily redacted personal data, relying on DPA exemptions to withhold much of the requested information.
Unsatisfied with the response, Mr Ashley issued court proceedings. The High Court ruled largely in Mr Ashley’s favour.
Key Takeaways
The scope of a DSAR:
- The scope of a DSAR is determined by the terms of the request read within its wider context.
- In Ashley, the request was framed broadly enough as to cover personal data held across the entire organisation, meaning HMRC was wrong in limiting the search to a single department.
The meaning of ‘personal data’:
- ‘Personal data’ is information that is ‘linked’ to an individual by a ‘continuum of relevance’.
- While ‘linked’ should be construed broadly, ‘an indirect or tenuous link at several removes is unlikely to suffice’.
- In Ashley, this meant that data relating to Mr Ashley’s properties, despite only indirectly relating to him, constituted personal data that should have been disclosed.
A ‘reasonable and proportionate search’:
- When controllers are determining whether replying to a DSAR would be ‘disproportionate’, they can consider the time taken to apply exemptions and make redactions alongside the time taken to search for the data.
- However, the court emphasised that HMRC should have fully understood its obligations and had systems in place to handle DSARs, implying that delays resulting from unpreparedness are likely to be unacceptable..
Providing data in a concise, transparent, and intelligible manner:
- Fulfilling the UK GDPR requirement to provide personal data in a concise, transparent, and intelligible manner requires supplying contextual information alongside the personal data where it is necessary for the data subject to fully understand how and why their data is processed.
- The court ruled that the personal data HMRC provided to Mr Ashley was insufficient as it included only decontextualised pieces of data.
Final Thoughts
A review of the UK GDPR, the Data Protection Act, the DUA Act, and ICO Guidance makes it apparent that a high-volume request or the need for extensive searching will rarely relieve an employer of its duty to respond to a DSAR.
While an employer can refuse a request if it is manifestly excessive or avoid certain searches if doing so would be disproportionate or unreasonable, the legal threshold is high. In practice, employers are likely to be required to invest in an utilise electronic search tools to manage large searches effectively.
This regulatory stance is reinforced by the recent case of Ashley v HMRC. The court’s judgement serves as a reminder that employers must not interpret DSARs in an unduly narrow fashion. It highlights that ‘personal data’ can encompass a wider scope of data than may be anticipated, and that employers are expected to understand their obligations under data protection law.
To mitigate the risks of non-compliance, employers should review their data practices and establish internal processes to prevent delays. Visit our Data Protection Lawyers page if you require further guidance on UK GDPR, data privacy, and protecting your organisation.
