A subject access request lands in your inbox on the morning you planned to send a campaign. The person is unhappy, the request is broad, and finding the information will take time.
Can you refuse a subject access request? Sometimes. But inconvenience, an awkward relationship or a suspicion that someone is looking for trouble is not enough.
For UK businesses, the sensible starting point is to recognise the request, record it and work out what response the law requires. This is general guidance, not legal advice on an individual case.
Recognise the request before judging it
A subject access request, often shortened to SAR, asks for someone’s personal data and related information about how it is used. It does not need to arrive on a special form or contain legal terminology.
For an email marketer, relevant information might include a subscriber record, signup evidence, preferences and correspondence. An unsubscribe request and a request for access are different things, although one message may contain both.
Log when the request arrived and give someone responsibility for handling it. The usual response period is one month, with specific rules covering matters such as identity checks and extensions. Do not assume that a difficult request gives you an unlimited pause.
Understand the narrow grounds for refusal
A relevant legal exemption may justify withholding some information or, in an appropriate case, refusing the request. Separately, a request may be refused if it is manifestly unfounded or excessive.
These are tests to apply to the circumstances, not convenient labels. You need evidence for the decision and a record of how you reached it.
- Manifestly unfounded: consider whether the evidence shows the person is not genuinely seeking to exercise their access rights. Do not infer this merely because they are angry.
- Excessive: consider the request in context, including its scope and the burden of responding. A large amount of information does not automatically make a request excessive.
- A specific exemption: identify the applicable provision and assess the information it actually covers. An exemption affecting one item need not justify withholding everything.
A difficult request still needs a proper decision.
Separate irritation from evidence
An existing complaint does not cancel someone’s access rights. Nor does an impolite email. Repeated requests need an individual assessment rather than an automatic refusal.
If you cannot immediately find the person in your marketing list, check other relevant systems and identifiers. They may have used another email address, contacted support or appeared in older records. Ask for proportionate clarification where necessary. Do not disclose data to someone whose identity has not been adequately established.
If a reasonable search finds no relevant personal data, explain that. ‘We cannot find data about you’ is a response to the request, not a reason to ignore it.
Consider partial disclosure before a blanket no
A record may contain information about the requester and someone else. That calls for an assessment of the other person’s rights and whether information can be redacted, rather than an automatic rejection of the whole request.
Keep a note of what you searched, what you found and what you withheld. Get specialist advice where an exemption, confidential material or competing rights make the decision uncertain.
If you refuse, explain the decision properly
A refusal normally needs to explain the reasons and tell the person about their right to complain to the ICO and seek a judicial remedy. The detail you can provide may depend on the exemption involved.
A useful internal record should identify the request, the decision-maker, the evidence considered and the information supplied or withheld. Keep the response factual. It is not the place to continue an argument.
Make the next request easier
Know where your subscriber information lives. Keep contact data and preferences organised, assign responsibility for requests, and make sure staff recognise them when they arrive.
Your next move: check whether your team knows who handles a SAR. Good preparation is more useful than a creative reason to say no.
The WizEmail Team
