Subject Access Request Automation in the UK: Data Mapping, Search, Redaction and Review
How to automate subject access requests under UK GDPR and the Data (Use and Access) Act: data mapping, ID checks, deadlines, search, redaction and review.
What should subject access request automation do?
A subject access request (SAR) system should log requests from any channel, verify identity proportionately, track the one-month deadline with pauses and extensions, use a data map to decide which systems to search, run and record reasonable and proportionate searches, gather results into a review workspace, suggest redactions for staff to approve, assemble the response with the required supplementary information, deliver it securely and keep an audit trail. Automation removes the chasing and copying. People still decide on exemptions, third-party information and what is proportionate.
This guide is for data protection officers, operations leads and engineering teams at UK organisations handling more than a few requests a year. It is general information as at October 2026, not legal advice.
What changed under the Data (Use and Access) Act 2025?
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and its main data protection changes came into force on 5 February 2026. For subject access, it confirmed in law that controllers need only make a reasonable and proportionate search, and that the time limit pauses while the controller waits for clarification it reasonably needs. The ICO's guidance says clarification cannot be requested as a matter of routine. Separately, from 19 June 2026 controllers must have a procedure for data protection complaints and acknowledge complaints within 30 days.
The ICO updated its guide to subject access in July 2026 to reflect these changes. Build your workflow around that guidance rather than older summaries.
Key takeaways
- Build the data map first; it drives every search.
- Model the deadline as a clock with starts, pauses and extensions.
- Record what you searched, how and why, as evidence of proportionality.
- Let software suggest redactions; let trained people approve them.
- Deliver through a secure, downloadable route, with alternatives.
- Handle data protection complaints in the same system.
Start with a data map
A data map lists where personal data lives, whose it is, how it is identified and how it can be searched. Many organisations already keep a record of processing activities; extend it with the technical detail a search needs.
| System | Data subjects | Identifiers | Search method | Owner |
|---|---|---|---|---|
| CRM | Customers, prospects | Email, customer ID, phone | API query | Sales operations |
| Helpdesk | Customers | Email, ticket ID | API export of tickets and attachments | Support lead |
| Email and files | Staff, customers, suppliers | Name, email | eDiscovery search with saved queries | IT |
| Product database | Users | User ID, email | Read-only query script | Engineering |
| HR system | Staff, candidates | Employee ID, name | Manual export by HR | HR |
| Processors (payroll, marketing) | Staff, customers | Varies | Request to processor under contract | Data protection officer |
How should the request workflow and deadlines work?
Requests can arrive by email, web form, letter, social media or through any member of staff, and do not need to mention the law. Log every one centrally, then move it through clear stages.
| Stage | What happens | Clock effect |
|---|---|---|
| Intake | Log request, channel, requester and scope | Starts on receipt, unless ID or authority is needed |
| Identity and authority | Ask only for what is proportionate; check third-party authority | Starts when you receive what you asked for |
| Clarification | Ask only if reasonably required, for example a vague request about a large volume of data | Pauses on the day you ask; resumes the day after the reply |
| Search | Run connector searches from the data map; record queries and results | Running |
| Review and redaction | Remove irrelevant material; assess third-party data and exemptions | Running |
| Extension | If complex or one of several requests, extend by up to two months | Tell the requester within the first month, with reasons |
| Response and close | Deliver copy and supplementary information; record outcome | Stops |
type ClockEvent =
| { kind: "start"; at: string } // receipt, or receipt of ID/authority/fee
| { kind: "pause"; at: string } // clarification requested
| { kind: "resume"; at: string } // day after clarification received
| { kind: "extend"; months: 1 | 2 }; // complex or multiple requests
// Store the events and recompute the due date whenever one is added,
// using your organisation's agreed calendar-month and working-day rules.Search connectors and proportionality evidence
Most of the time saved comes from connectors: API searches of the CRM and helpdesk, saved eDiscovery queries for email and files, and read-only scripts for product databases. For each search, record the system, query terms, date range, who ran it, the number of results and anything excluded with a reason. That record is how you show the search was reasonable and proportionate if the requester or the ICO asks.
- Search by every identifier the requester gave, not only email.
- Include attachments, comments and logs where they hold personal data.
- Ask processors through a tracked task with a due date.
- De-duplicate results before review.
- Never let search scripts write to production systems.
Redaction and review
Third-party information is the hardest part. The ICO's guidance sets out how to decide whether to disclose information about other people: whether it can be separated, whether they have consented, and whether disclosure without consent is reasonable. Software can help by detecting names, email addresses, phone numbers and other identifiers and proposing redactions, but a trained reviewer should approve each one and record why.
- Redact properly: remove the underlying text and metadata, not just cover it.
- Keep an unredacted copy and a redaction log, both access-controlled.
- Flag possible exemptions, such as legal professional privilege, for specialist review.
- If you use an AI model to suggest redactions, assess where data is processed and keep a human decision on every disclosure; see AI data privacy.
Responding and delivering
The response includes a copy of the personal data and supplementary information that largely matches a privacy notice: purposes, categories, recipients, retention, the right to complain and the source of the data. Provide it in a commonly used electronic format if the request was electronic. A secure portal works if the person can download an accessible copy, with another method for people who cannot use it. If you refuse all or part of a request, explain why and tell the person about their right to complain to you and to the ICO.
Handling complaints in the same system
Since 19 June 2026, controllers must have a way to receive data protection complaints, acknowledge them within 30 days, investigate and tell the person the outcome without undue delay. Complaints often follow subject access requests, so link complaints to the original request, accept them from any channel, and keep records of correspondence, investigation steps and outcomes.
Build, buy or combine?
Privacy management platforms include request portals, workflows and connectors to common SaaS products, and suit many organisations. Custom work makes sense for connectors to bespoke or legacy systems, for search across large product databases, or when requests need to fit an existing case management system. A common pattern is to buy the workflow and build the connectors. For retention and deletion design, see privacy by design in software development, which covers the engineering patterns even though its legal sections are Australian.
Hypothetical example: a multi-site dental group
This example is hypothetical. A UK dental group receives a growing number of SARs, often linked to complaints, and handles them by email between practices. It maps where patient data sits (practice management system, imaging, call recordings and email), sets up a central request log with an identity check and a deadline clock, adds export scripts for the practice system and imaging archive, and routes results to a reviewer who approves suggested redactions of other patients' and staff details. Clinical records are reviewed by a clinician before release. Every search and decision is logged.
Common mistakes
- Only logging requests that arrive through the official form.
- Asking for clarification by default to stop the clock.
- Searching only systems someone remembers.
- Redacting by covering text in a PDF that can still be copied.
- No record of searches, exclusions and reasons.
- Excessive identity checks for people you already know.
Sources
Regulator and law: ICO: A guide to subject access (updated 16 July 2026); Data (Use and Access) Act 2025.
Commencement and complaints commentary: DLA Piper: commencement of DUAA data protection provisions; Lewis Silkin: ICO guidance on data protection complaints.
Accessed 10 October 2026. Some commencement details come from law-firm summaries; check the ICO and legislation.gov.uk for the final position. Nothing here is legal advice.
Conclusion
Subject access automation works when it starts from a data map, models the deadline as a clock with pauses and extensions, records the evidence behind each search, and keeps people in charge of redaction and exemptions. With the Data (Use and Access) Act's changes now in force, build to the ICO's current guidance and handle complaints in the same system.
Spending days on each subject access request?
ZSpace Labs is a remote-first technology studio that works with clients globally on case workflows and integrations and document processing with human review. We have no UK office and work alongside your data protection officer and legal advisers. If it would help to map your systems and connectors, we are happy to talk it through.
Common questions.
Without undue delay and within one month of receipt. The clock starts once you have any identity information, proof of a third party's authority or fee you asked for. You can extend by up to two further months if the request is complex or the person has made several requests, provided you explain why within the first month.