Disproportionate searches
Searching everything wastes weeks. Excluding sources with no recorded rationale invites challenge. The new statutory standard cuts both ways.
What the Data (Use and Access) Act 2025 changed for DSARs
The Data (Use and Access) Act 2025 (DUAA) made the most significant changes to DSAR handling since the UK General Data Protection Regulation (UK GDPR) came into force. Three matter most in practice. (Reviewed July 2026.)
- Reasonable and proportionate searches. Since 5 February 2026, you are only required to carry out a reasonable and proportionate search when responding to a DSAR. The protection is conditional: if you exclude a system or data source from your search, you must be able to evidence why that exclusion was reasonable.
- Stop the clock. If you reasonably need more information from the requester, to verify identity or clarify the scope of the request, the one month response period pauses until you receive it. The Information Commissioner’s Office (ICO) has been clear it will look at how the pause is used.
- A direct complaints duty. Since 19 June 2026, individuals have a statutory right to complain directly to your organisation. You must provide an accessible way to complain, acknowledge complaints within 30 days, and respond without undue delay.
What has not changed: the one month deadline still applies, extendable by up to two further months for complex or multiple requests. Exemptions, including legal professional privilege and third party data, still apply, and the ICO can still investigate. What has changed is that your protections now depend on being able to show your working.
Where DSAR responses go wrong
The problems we see follow a pattern: decisions made under deadline pressure, with nothing recorded to defend them later.
Deadline mismanagement
The one month clock runs from receipt, and pausing it has rules. Clarification requests used as delay tactics attract ICO attention.
Third party data and redaction
Other people's personal data must be protected without over-redacting what the requester is entitled to see. Both errors carry consequences.
Privilege mistakes
Legally privileged material disclosed in error cannot be recalled. Material withheld without documented grounds invites complaint.
Requests arriving mid-dispute
Many contentious DSARs precede tribunal claims or litigation. The response itself becomes part of the record and will be scrutinised.
No complaints process
Since 19 June 2026 you must handle data protection complaints directly, with acknowledgement within 30 days. Most organisations have no process in place.
A DSAR response is a piece of evidence. We treat it like one.
Most providers treat a DSAR response as a processing exercise: collect the data, run the searches, redact, send. That works until the response is scrutinised. Our background is investigative. Chain of custody, documented methodology and decisions that withstand scrutiny come from our founder’s work as a forensic investigator at New Scotland Yard’s Hi-Tech Crime Unit, and from close to two decades of digital forensics and eDiscovery work since Forensic Control was founded in 2008.
A managed DSAR response with us follows five steps:
- Initial call. We establish what has been asked for, who is asking, and the context in which the request arrives.
- Scope. We define the custodians, systems and date ranges a reasonable and proportionate search should cover, and record why.
- Clarify where needed. If the request is unclear, we help you seek clarification properly, pausing the clock while you wait.
- Search, review and redact. Forensic collection preserving metadata, then review for relevance, privilege and third party data on Reveal, our document review platform.
- Produce and document. Delivery to the requester, with a decision log standing behind every inclusion, exclusion and redaction.
If the response is later complained about, or challenged before the ICO or a tribunal, the documentation needed to defend it already exists
Wider eDiscovery and forensic services
DSAR support sits within our wider eDiscovery practice, handled by the same senior consultants.
Forensic data collection
Court-admissible collection of electronically stored information from cloud platforms, devices and archives, preserving metadata and chain of custody.
Managed document review
Full lifecycle management from early case assessment through to production, with review on Reveal.
Expert witness reporting
Court-ready forensic reports and expert witness testimony when digital evidence must stand up in proceedings.
Digital forensics
Investigative-grade examination of devices and data in cases of fraud, dispute or suspected internal wrongdoing.
"In eDiscovery, the difference between a good outcome and a poor one is often the quality of the scoping conversation at the start. We have that conversation with you directly."
Greg Deane
Manager, eDiscovery & Litigation Support
Frequently asked questions
Practical answers to the DSAR questions organisations ask us most often
What is a reasonable and proportionate search for a DSAR?
Can we pause the one month DSAR deadline?
Can we refuse a DSAR for being too broad?
Do we have to respond to a DSAR made during a dispute or tribunal claim?
What is the new DSAR complaints duty?
How long does a DSAR response take?
Speak directly with our consultants about a DSAR
Whether a request has just arrived, a deadline is close, or you want a process in place before the next one comes, we can help. Book a short call to talk through where you are.
