Weaponised Subject Access Requests: How to Respond

What Is a Weaponised Subject Access Request?

A “weaponised” Subject Access Request (SAR) is a SAR that is being used as part of a wider dispute or strategy, rather than simply because someone wants to understand what personal data an organisation holds about them.

You often see this during a grievance, disciplinary process, redundancy consultation or employment dispute. Someone might use a SAR to find out what has been said about them internally, gather information about how decisions were made, or obtain material they think could support their position.

However, this is still a SAR…

The motivation behind the request does not automatically make it invalid, and an organisation cannot simply refuse to deal with it because it believes the individual is trying to gain an advantage in a dispute. The term “weaponised” describes how the SAR may be being used but it does not remove the individual’s legal right of access to their personal data under UK GDPR.

That distinction matters: when a SAR lands in the middle of an already difficult situation, it can be tempting to see it as part of the dispute and look for a reason not to respond and that is where organisations can get themselves into trouble.

The better approach is to recognise the wider context, understand exactly what the individual is asking for, and handle the SAR properly.

How to Spot It

There is no definitive test, but there are some patterns we see regularly here in DPP:

• Timing: the SAR arrives immediately after a grievance is raised, disciplinary action begins, redundancy is discussed or another dispute develops.
• Scope: the individual asks for “everything” about them, every email, Teams message, note, document or conversation in which they are mentioned.
• Target: the wording focuses heavily on communications involving a particular manager, colleague or decision-maker.
• Purpose: the request appears designed to uncover internal discussions, opinions or information connected with a separate dispute.
• Pattern: the individual submits repeated or overlapping SARs, sometimes shortly after an earlier request has been completed.

None of these things automatically makes a SAR invalid, excessive or something you can refuse! They are simply signs that context matters. A broad request made during an employment dispute may be frustrating and time-consuming, but that does not mean an organisation can dismiss it as “weaponised” and move on.

From experience, the real question in this scenario is not “can we get out of responding to this?” but “how do we respond properly and proportionately?”

We break down real examples and the practical challenges organisations face in Weaponised SARs: A Growing Challenge for Organisations, the first episode in our series on this topic.

What Changed Under the Data (Use and Access) Act 2025?

The Data (Use and Access) Act 2025 (DUAA) introduced some useful changes to how organisations can deal with SARs, particularly when requests are very broad or difficult to manage.

You Don’t Have to Search Absolutely Everywhere

The law now makes it clear that organisations only need to carry out searches that are reasonable and proportionate. This doesn’t mean you can ignore parts of a SAR because they are difficult or time-consuming. But it does mean you are not expected to carry out endless searches where the effort involved would be unreasonable compared with the information you are likely to find.

This can be particularly helpful with very broad SARs asking for things like “every email, message, note and document that mentions me”.

The important thing is to make a sensible decision about what should be searched and keep a record of why.

You Can Ask for Clarification and Pause the Clock

If a SAR is so unclear that you genuinely can’t tell what the person is looking for, you can ask them to clarify their request and while you are waiting for their answer, the response clock can be paused.

But you can’t use clarification simply as a way to buy more time or force someone to make their SAR smaller! There needs to be a genuine reason for asking.

If you reasonably need proof of identity, the timing works slightly differently. The one-month response period does not start until you have received the information you need to confirm who the person is.

You Still Normally Have One Month to Respond

The basic deadline hasn’t changed: you normally have one month to respond to a SAR. In some cases, you can extend this by up to a further two months if the request is complex or the person has made several requests.

The DUAA hasn’t given organisations a way to simply reject difficult or weaponised SARs but what it has done is give organisations clearer tools to manage them properly.

The message is simple: you still have to deal with the SAR, but you don’t have to make the process harder than it needs to be.

We discussed these changes and answered practical questions about difficult SARs in Weaponised SARs Part 2: Live Discussion and Q&A.

How to Respond to a Weaponised SAR, Step by Step

A difficult or weaponised SAR still needs to be handled properly: the key is to stay organised, keep the request focused and record the decisions you make along the way.

Understand What They Are Actually Asking For

The first step should be to read the request carefully and understand what information they are looking for. Is there a particular person, decision, period of time or issue they are interested in?

If the request is unclear and you genuinely need more information to understand what they want, you can ask them to clarify it. The response clock can be paused while you wait for their answer. But a broad request does not automatically give you a reason to ask for clarification, and you cannot force someone to narrow their SAR just because it would make it easier to deal with.

Check Their Identity, Where Necessary

You need to be satisfied that the person making the SAR is who they say they are. That does not mean asking everyone for a passport or driving licence. Any identity checks should be reasonable and proportionate to the circumstances. Nevertheless, if you genuinely need more information to confirm their identity, the one-month response period does not start until you receive what you need.

Search Where the Information Is Actually Likely to Be

Organisations do not need to search every system in the organisation just in case something might be there: it is important to focus on the places where the person’s information is reasonably likely to be found. That could include particular mailboxes, Teams messages, HR systems, shared folders or other relevant records.

The search needs to be reasonable and proportionate, and you should be able to explain why you chose the areas you searched.

Review the Information Properly

Finding a document does not automatically mean the whole document needs to be disclosed. You may need to remove information about other people or apply one of the legal exemptions available under data protection law.

The important thing is to apply redactions and exemptions carefully and consistently. This is the stage our SAR Support team deals with every day, including requests involving thousands of pages of information.

Decide How You Are Going to Respond

This is a very important step! In most cases, you will respond to the SAR and provide the information the person is entitled to receive, with any necessary redactions or exemptions applied.

In some cases, you may consider refusing all or part of the request, or charging a reasonable fee, because it is manifestly unfounded or excessive. That is a high bar. As we could see from our last episode on the podcast, a request is not excessive simply because it is large, inconvenient or arrives during a difficult dispute. You need to look at the circumstances of the individual request and be able to justify your decision.

Keep a Record of Your Decisions

Document what you did and why. It is essential that you keep a record of the searches carried out, any clarification requested, the exemptions applied, the reasons for redactions and any decision to refuse or charge a fee. If the requester later complains, or the ICO asks questions, you should be able to show how you reached your decision.

Common Mistakes to Avoid

Some of the biggest problems we see are actually quite simple:

• Ignoring the SAR because it looks tactical. Whatever the person’s motivation, it may still be a valid SAR.
• Missing the deadline. A difficult grievance or employment dispute does not stop the SAR clock.
• Searching absolutely everywhere. Focus on reasonable and proportionate searches instead.
• Redacting inconsistently. Similar information should be treated in a consistent way.
• Refusing a request simply because it is large. Size alone does not make a SAR excessive.
• Failing to record your reasoning. If you cannot explain why you made a decision, it becomes much harder to defend later.
• Leaving the review entirely to people involved in the dispute. Where possible, involve someone who can look at the information objectively, particularly where the SAR is sensitive or contentious.

The aim is not to “beat” a weaponised SAR. It is to stay in control of the process, apply the law properly and avoid creating another problem on top of the dispute you already have.

Do You Need Outside Help?

Not every difficult SAR needs outside support. Many can be handled perfectly well in-house. But weaponised SARs often arrive at the worst possible time: there is already a dispute underway, relationships may be strained, large amounts of information need to be reviewed, and the SAR deadline is still running in the background. Outside support can be particularly useful where:

• The request involves a large amount of information.
• The people who would normally handle the SAR are involved in the underlying dispute.
• Significant redaction or exemptions are likely to be needed.
• Internal teams simply don’t have the time or capacity to deal with it.
• You want an independent pair of eyes on a particularly sensitive request.

The important thing is knowing when a SAR is becoming too difficult or time-consuming to manage alongside everything else.

Our SAR Support team can help with the process, from supporting searches and reviewing documents through to redaction and preparing the final response. This can help keep the SAR organised, consistent and separate from the wider dispute.

We’ve also covered weaponised SARs across three episodes of our podcast, looking at real scenarios and the practical issues organisations face:

• Weaponised SARs: A Growing Challenge for Organisations
• Weaponised SARs Part 2: Live Discussion and Q&A
• Weaponised SARs Part 3

If you’d rather have a specialist team handle a request like this directly, that’s exactly what our SAR Support service is built for.

Frequently Asked Questions

Is a Weaponised SAR Still Legally Valid?

Yes. The fact that someone makes a SAR during a dispute, grievance or legal claim does not make it invalid. You still need to deal with it as a SAR and follow the normal rules.

Can We Refuse a Weaponised SAR?

Not simply because you think it is being used strategically. You may be able to refuse all or part of a request if it is manifestly unfounded or excessive, but this is a high bar. You need clear reasons for the decision and should keep a record of how you reached it.

What Changed Under the Data (Use and Access) Act 2025?

The Act made it clear that organisations only need to carry out reasonable and proportionate searches when responding to a SAR. It also introduced clearer rules around asking for clarification. If you reasonably need more information to understand what the person is asking for, the response clock can be paused while you wait for their answer.

If you reasonably need information to confirm someone’s identity, the one-month response period does not start until you receive it.

How Long Do We Have to Respond?

Normally, one month. The deadline can be extended by up to a further two months where necessary because of the complexity or number of requests. If you are extending the deadline, you need to tell the requester within the first month and explain why.

Do We Have to Disclose Information About Other Employees?

Not necessarily. A document can contain both the requester’s personal data and information about somebody else. You need to consider the rights of both people before deciding what can be disclosed. Sometimes this means redacting the other person’s information. In other cases, it may be reasonable to disclose it. It depends on the circumstances.

Should We Handle a Weaponised SAR Internally or Get Outside Support?

Either can work. If you have the time, experience and resources to handle the SAR properly, there is nothing wrong with dealing with it internally. Outside support can be useful where the request is particularly large or sensitive, your team is already stretched, or the people who would normally deal with the SAR are involved in the underlying dispute.

The important thing is making sure the request is handled fairly, consistently and on time.

Does Someone Have to Tell Us Why They Are Making a SAR?

No. Someone does not normally need to explain why they want access to their personal data. Even if you believe the SAR is connected to a grievance, employment dispute or legal claim, you still need to deal with the request properly.

Can We Ask Someone to Narrow Down a Very Broad SAR?

You can ask, but you cannot force them to make their request smaller just because it would be easier for you to deal with. If you genuinely need clarification to understand what information they are asking for, you can ask for it and, where the legal requirements are met, pause the response clock while you wait.

Is a Very Large SAR Automatically Excessive?

No. A request is not excessive simply because it involves a lot of emails, documents or other information. You need to look at the circumstances of the request before deciding whether it is manifestly excessive.

What If the SAR Asks for Every Email That Mentions the Person?

You still need to carry out reasonable and proportionate searches, but that does not necessarily mean searching every mailbox and system across the organisation. Think about where the person’s information is actually likely to be held, who is likely to hold it and what searches are reasonable in the circumstances.

Do We Have to Provide Every Document We Find?

No. A SAR gives someone the right to access their personal data, not necessarily every document that contains their name. You need to review what you find and decide what personal data the person is entitled to receive, whether information about other people needs to be protected and whether any exemptions apply.

What If the SAR Is Connected to an Employment Tribunal or Legal Claim?

The existence of a separate legal dispute does not remove someone’s right to make a SAR. You should deal with the SAR under the data protection rules while also considering whether any exemptions apply to particular information, such as information covered by legal professional privilege.

Can We Charge Someone for Making Repeated SARs?

Not automatically. SARs are normally free. In some circumstances, you may be able to charge a reasonable fee where a request is manifestly unfounded or excessive, including where its repetitive nature makes it excessive. You need to be able to justify that decision.

Can Someone Make Another SAR After We Have Already Responded to One?

Yes. There is no general rule preventing someone from making another SAR. However, if requests become repetitive or overlap heavily with requests you have already answered, that may be relevant when considering whether a new request is manifestly excessive.

What Happens If We Miss the SAR Deadline?

Don’t ignore it just because the deadline has passed. Complete the response as soon as possible, keep a record of what caused the delay and consider whether you need to improve your process. The individual can complain to the organisation and may also raise the matter with the ICO.

Should HR Deal With a Weaponised SAR If It Relates to an Employee Dispute?

HR can be involved, particularly because they may know where relevant information is held, but the SAR should still be handled as a data protection request. Where HR staff are directly involved in the dispute, it can be sensible for someone else to oversee the review and decisions around disclosure, redaction and exemptions.

Next Step

A weaponised SAR is manageable when it’s handled properly and on time. If one has landed on your desk, or you want your process ready before it does, get in touch with our SAR Support team.