Introduction
For a decade, the subject access request (SAR) has been one of the data protection rights most dreaded by controllers, yet one of the least scrutinised by the regulator. That changed on 19 June 2026 by virtue of Section 103 of the Data (Use and Access) Act 2025 (“DUAA”) inserting section 164A into the Data Protection Act 2018 (“DPA 2018”) - introducing a statutory obligation on controllers to operate an effective procedure for handling data protection complaints.
The implications for DSAR compliance are significant: organisations must now be able to demonstrate not only that they can respond to SARs, but also that they have an effective process for receiving, investigating and responding to complaints about their handling of them.
The Current Legal Framework
The right of access is guaranteed by Article 15 UK GDPR, with a one-month response deadline under Article 12(3). Refusal is permitted only on limited grounds, including where a request is manifestly unfounded or excessive under Article 12(5). In Dawson-Damer v Taylor Wessing LLP [2017] EWCA Civ 74, the Court of Appeal confirmed that a collateral purpose for the SAR, including anticipated litigation, does not of itself justify refusing a subject access request.
Controllers should also understand the limits of the regulatory complaints process. A complainant who refers a DSAR dispute to the ICO cannot necessarily require the Commissioner to conduct a full investigation or reach a particular conclusion. In R (Delo) v Information Commissioner [2024] 1 WLR 263 (CA), Warby LJ confirmed that the Commissioner must reach an “outcome”, but need only investigate “to the extent appropriate”. That outcome may simply be a view that the controller has “likely” complied.
New Rules
The DUAA amends the access framework by introducing Article 12A UK GDPR, which recalibrates the response-time requirements, including when the response period begins and when it may be paused pending further information reasonably required to identify the data or processing activities concerned. It also inserts Article 15(1A), limiting the right of access to information obtainable following a “reasonable and proportionate search”. This does not confer unrestricted discretion to limit searches; controllers must still be able to justify their approach in light of the circumstances and the ICO’s updated guidance.
Arguably, the most significant change introduced by the DUAA is the creation of a statutory complaints-handling regime, through which section 164A of the Data Protection Act 2018 imposes new obligations on controllers from 19 June 2026. Controllers must provide accessible means of submitting data protection complaints, acknowledge receipt within 30 days, take appropriate steps to investigate and respond without undue delay, and communicate the outcome to the complainant. Regulation 7 of the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 confirms that these requirements apply to complaints received on or after 19 June 2026.
The High Court’s decision in Ashley v HMRC [2025] EWHC 134 (KB) illustrates the need for a balanced approach to SARs. The court held that HMRC had construed the access request too narrowly by limiting its scope to just one department, while rejecting the proposition that all information connected with its investigation constituted the claimant’s personal data. Although decided before the DUAA, Ashley remains relevant to the interpretation of Article 15(1A): a reasonable and proportionate search does not permit arbitrary restrictions on the scope of a request or searches that cannot be justified.
From DSAR Compliance to Complaints Accountability
The message for controllers is clear: responding to DSARs is no longer the whole compliance picture. Since 19 June 2026, organisations must also be able to demonstrate that data protection complaints can be submitted, properly investigated and resolved within the statutory framework. That requires more than a policy on paper. It means accessible reporting channels, clear ownership, documented decisions, appropriate escalation procedures and effective oversight.
The precise meaning of “appropriate steps” and “without undue delay” may develop through ICO guidance and future case law. In the interim, controllers should not wait for regulatory intervention to expose weaknesses in their frameworks. Reviewing existing procedures, testing how complaints are handled in practice and retaining a clear audit trail are now essential elements of effective data protection governance.
Need help reviewing your DSAR and complaints-handling procedures?
Jurisprudence Legal advises organisations on DSAR response strategies, data protection complaints procedures and wider UK GDPR compliance. We can help you assess your current arrangements, identify compliance gaps and implement a robust framework that meets the new statutory requirements.
Contact us at info@jurisprudence-legal.com to discuss how we can help.
This article is intended for general information purposes only and does not constitute legal advice.
