Subject Access Requests (SARs) remain one of the most resource-intensive aspects of data protection compliance. With the Data (Use and Access) Act 2025 (DUAA) now fully integrated into the ICO’s regulatory guidance on SARs, several key principles have been codified to provide organisations with greater legal certainty.

While the core right of access remains unchanged, the rules of engagement for managing complex or broad requests have evolved.

Key Statutory Updates

• “Stopping the Clock”: Organisations can now formally pause the one-month
  response window if they reasonably require clarification to identify the information requested. However, the ICO clarifies that this is not a total pause - you must still provide any supplementary information (such as details of the individual’s rights, your purposes for processing, or your retention periods) within the original timeframe if that information can be provided without the clarification.
• The “Reasonable and Proportionate” Standard: The DUAA codifies that a controller is only required to conduct a search that is “reasonable and proportionate”. This confirms you are not required to conduct searches that would be disproportionate to the importance of providing access to the information, although you must be prepared to justify your search strategy if challenged.

Practical Realities for Tech-Driven Businesses

Operational friction remains a significant risk, particularly for businesses with fragmented tech stacks. The updated guidance highlights that technical difficulties can be a factor in extending the deadline by a further two months, but these are not an excuse for poor data governance.

• The Collaboration Trap: Platforms like Slack and Teams are high-volume,
  unstructured data sources. The ICO expects modern businesses to have efficient
  retrieval mechanisms in place. Relying on manual screenshots or staff-led searches is increasingly viewed as a high-risk strategy that can lead to delays and data leakage.
• Shadow IT & Personal Accounts: If business is conducted on WhatsApp or
  personal SMS, that data is in scope. The new guidance reinforces that internal
  policies must define the boundaries of “professional” vs “personal” to ensure you can retrieve this data effectively when a SAR arrives.
• Redaction Readiness: The requirement to respond “without undue delay” means that manual redaction is often the primary cause of missed deadlines. The ICO’s updated complexity criteria suggests that while sheer volume alone may not justify an extension, the need for specialist redaction in sensitive or multi-party contexts might.

Key takeaways

The DUAA and the subsequent ICO guidance offer a more pragmatic framework for UK businesses, but they also raise the bar for accountability. Success isn’t just about knowing the law - it’s about ensuring your tech stack and internal processes are SAR-ready before the clock starts ticking.