SAR refused or information withheld

A refusal does not automatically mean the organisation is wrong, but it should be able to identify the legal basis, apply it to the facts and explain your complaint rights.

Reviewed: September 2026UK information-rights guidance

Start with what was actually refused

A SAR response can be complete, partly redacted, partly withheld or refused entirely. Ask yourself whether the organisation is relying on an exemption to particular information, saying the information is not your personal data, saying it is not held, or treating the request as manifestly unfounded or excessive. Those are different issues.

Common SAR exemptions and restrictions

Information about other people

The organisation does not have to disclose information to the extent that doing so would reveal another person's information, unless that person consents or it is reasonable to disclose without consent. Redaction is often the practical result.

Legal professional privilege

Personal information can be exempt where a claim to legal professional privilege (or the relevant Scottish confidentiality protection) could be maintained, or where a professional legal adviser owes a duty of confidentiality to the client.

Crime, taxation and regulatory functions

Specific exemptions can apply where disclosure would prejudice defined public functions or purposes. The exact test matters.

Management information, negotiations and confidential references

The DPA 2018 contains targeted exemptions for particular categories and circumstances. They should not be treated as blanket labels for an entire file.

Manifestly unfounded or excessive

The threshold is high. A large request is not automatically excessive. The organisation should consider all the circumstances and support its conclusion with clear evidence. If the provision applies, it can refuse wholly or partly or may choose to charge a reasonable fee instead.

Reasonable and proportionate search is not an exemption

The DUAA confirms that an organisation need only make reasonable and proportionate searches for information in response to a SAR. That can limit the search exercise, but it is analytically different from applying an exemption to information that has been found. If you think obvious sources were not searched, ask what the organisation did to locate the data.

What a refusal should tell you

Where the organisation refuses to comply with a SAR, it should normally explain the reasons, tell you about your right to make a complaint to it, tell you about your right to complain to the ICO and tell you that you can seek to enforce the right through the courts.

Challenge the decision

There is no FOIA-style statutory “internal review” for an ordinary UK GDPR SAR. Use the organisation's data-protection complaint process. Since 19 June 2026, that complaint-handling process is a legal requirement for controllers.

Subject: Data protection complaint — SAR refusal / withholding I am making a data-protection complaint about your response to my subject access request dated [date]. I dispute [identify the refusal, exemption, redaction or search issue]. In particular: [brief reasons]. Please review the decision, identify the precise legal basis relied on and explain how it applies to the information in question. If the issue is search adequacy, please explain the reasonable and proportionate searches carried out. Yours faithfully, [Name]

Official sources

Reviewed September 2026. This page is general information, not legal advice. For a live dispute or critical deadline, check the current ICO guidance and legislation.