A difficult access request is not automatically an excessive one, and an organisation’s inability to find its own data should not become the data subject’s burden.
Introduction
One of the more concerning trends I have observed is the tendency to describe Subject Access Requests as excessive, disproportionate or a nuisance because of the volume of material an organisation must search and review. The reasoning often focuses on fragmented systems, large mailboxes, limited resources or the difficulty of completing review within the statutory timeframe.
I recognise that some requests are genuinely complex and that the GDPR provides a limited framework for dealing with manifestly unfounded or excessive requests, as well as an extension in appropriate cases where requests are complex or numerous. However, complexity is not the same as excess, and difficulty is not the same as abuse.
My concern is that organisations can sometimes allow shortcomings in their own technology, records management or governance to shape their view of the individual exercising the right. In my opinion, the better question is not why the data subject has asked for so much, but why the organisation cannot readily identify and manage the information it has chosen to collect and retain.
Eight years on, preparedness should be expected
The right of access is not new, and organisations have now had eight years since the GDPR became applicable to develop the governance and operational capability needed to support it. This does not mean that every DSAR will be simple or that every response will require the same level of effort. It does mean that rights handling should be an established business capability rather than an improvised exercise each time a request arrives.
Organisations are not passive recipients of information. They decide what to collect, which systems to use, how widely information is shared and how long it is retained. Each new platform, mailbox, repository and dataset adds to the data estate. Those choices bring benefits, but they also bring responsibility.
It is increasingly difficult to argue that an individual’s access rights should be restricted merely because the organisation has accumulated more information than it can efficiently govern. The burden created by the organisation’s own data environment should not automatically be transferred to the requester.
A DSAR is a test of real compliance
A Subject Access Request often reveals more about privacy maturity than a policy review. An organisation may have a detailed procedure and an attractive request form, but the true test begins when teams must locate the relevant information across live systems, archives, shared drives, collaboration platforms and local records.
At that point, basic governance questions become operationally important. Does the organisation know where personal data is held? Are system and business owners identifiable? Are retention periods understood and implemented? Can duplicate or irrelevant material be separated efficiently? Is there a consistent approach to review, redaction, exemptions and quality assurance?
If these questions cannot be answered, the underlying issue is unlikely to be limited to DSAR handling. It may indicate weaknesses in data mapping, retention, access control, supplier governance and accountability more generally.
What a data subject would reasonably expect
It is useful to step away from regulatory terminology and consider the position of the individual. A data subject does not need to understand the organisation’s system architecture, legacy arrangements or internal reporting lines. If an organisation chooses to collect and use information about them, they are likely to expect that the organisation can locate and explain that information when asked.
From that perspective, statements such as ‘we have too many systems’ or ‘there are too many files’ are unlikely to be reassuring. The individual did not design the data environment, choose the retention model or decide that information should be duplicated across multiple repositories.
This is why the tone used in responding to complex DSARs matters. Constructive engagement and proportionate clarification can help identify what the individual is seeking. It should not, however, become a means of pressuring the requester to solve an information governance problem that belongs to the organisation.
Excessive cannot simply mean difficult
There is an important distinction between a request that is genuinely manifestly unfounded or excessive and one that is simply large, time-consuming or inconvenient. A high volume of potentially relevant documents may make review more demanding, but volume alone does not necessarily determine the legal character of the request.
Organisations should therefore be cautious about using labels such as nuisance, disproportionate or excessive as shorthand for operational difficulty. Any decision to refuse, charge for or limit a request should be grounded in the applicable legal test, supported by evidence and considered in light of the individual’s circumstances and communications.
This is also an area where strong DPO involvement is valuable. The DPO can challenge assumptions, help distinguish genuine abuse from complexity and ensure that operational pressure does not displace the rights-based purpose of the process.
The governance capability organisations should now have
A mature data protection programme should maintain accurate records of processing, meaningful data maps, clear ownership and workable retention controls. Data classification should help the organisation understand the sensitivity and business context of information, while search and discovery capability should support retrieval across relevant systems.
These controls should connect to a defined DSAR workflow. Search instructions should be recorded, custodians identified, results de-duplicated where appropriate, relevance assessed consistently and redactions subject to quality assurance. The process should also create a defensible audit trail showing how the organisation approached the request and why key decisions were made.
No single register or technology will solve every challenge. The real capability comes from aligning people, process, information governance and appropriate tools. When one of those elements is missing, manual effort increases and the risk of delay, omission or inconsistent decision-making grows.
Technology and investment are now part of the answer
Many organisations still manage large DSARs by searching individual locations, opening files one by one and applying redactions manually. There will always be a need for human judgement, particularly when assessing context, third-party information and exemptions. However, human judgement should be supported by effective search, deduplication, review management and redaction capability.
Organisations routinely invest in systems that improve sales, customer service, security and operational efficiency. In my view, the ability to find and govern personal data deserves the same strategic attention. It is not merely a privacy team convenience. It supports litigation readiness, incident response, records management, regulatory engagement and organisational knowledge.
Where recurring DSAR volumes or complex data estates are foreseeable, failure to invest in capability becomes increasingly difficult to defend as a temporary problem. Sustainable compliance requires organisations to assess their demand, risk and data landscape, and to put proportionate resources in place.
The one-month timeframe should shape programme design
The GDPR’s default response period means that organisations cannot wait for a request to arrive before working out where information is held or who must search for it. Intake, identity verification, scoping, search, review, redaction, approval and secure disclosure all have to operate within a tightly managed process.
Where an extension is lawfully available because of complexity or number, it should not become the routine operating model. Nor should it substitute for investment in repeatable processes. The statutory timeframe should influence system design, retention practice, staffing arrangements and escalation routes long before a particular request is received.
Preparedness is particularly important because DSAR demand can be unpredictable. An organisation with clear ownership, current registers and established search methods is far better placed to respond proportionately than one attempting to reconstruct its data landscape under time pressure.
Final thoughts
A DSAR is rarely just an administrative request. It is often one of the clearest tests of whether an organisation genuinely understands the personal data it holds and can exercise control over it.
When an organisation can identify relevant systems, retrieve information, assess context, apply necessary redactions and provide a clear response within the applicable timeframe, it demonstrates that data protection has been embedded into governance and operations. When it cannot, the request may expose weaknesses that extend well beyond data subject rights.
Eight years into the GDPR era, the conversation should move away from whether access requests are burdensome and towards whether organisations have invested in the people, processes and technology needed to honour a right that has long been part of the regulatory landscape. A difficult request may be challenging, but the organisation’s lack of preparedness should not become the data subject’s problem.