They said this… · Data protection & SARs

“A SAR means we must give you every document that mentions you in full”

Generally incorrect

Subject access is a right to personal data and supplementary information, not automatically to complete unredacted copies of every document.

Not sure which right applies? Check your situation →

Why this answer

What actually matters

  • Providing copies of documents can be a practical way to supply personal data.
  • Third-party data and exemptions can justify redaction/withholding in appropriate cases.
  • The controller must still provide the requester’s personal data in an intelligible form.

What you could say

Keep the response tied to the actual rule.

Evidence

What to have beside you

  • Original request/complaint and proof of receipt
  • Every ID, clarification or extension message
  • A list of data categories you know or reasonably expect to exist
  • The response pack, redactions, file metadata and missing categories

If they still refuse

Move the dispute forward.

  1. Challenge the controller precisely: identify the missing data, disputed accuracy or rule you say has been misapplied.
  2. Use the organisation’s data-protection complaint route where appropriate.
  3. The ICO can consider data-protection compliance, but compensation normally requires a different route.

Read the full rules

Go deeper before escalating.

Primary guideRead the detailed ConsumerWise guidance.Subject access requestsRead the full guide.Challenging a SAR responseRead the full guide.Data accuracyRead the full guide.