AI-Generated Subject Access Requests: What Employers Need to Know

Ask any data protection lead, HR manager or compliance lead what’s changed in the last year, and many will say the same thing: Subject Access Requests (SARs) are becoming more detailed, more sophisticated and, in some cases, harder to manage.

Requests are longer. Individuals sound more confident. Requests are full of the right legal language in roughly the right places.

And there’s a simple reason for this: a growing number of requests may have been drafted, or at least assisted, by Artificial Intelligence (AI).

Anyone can make a SAR

Pre-AI, making a SAR used to take a bit of effort. Individuals had to know the right of access even existed, figure out who to send it to, and write something clear enough to be taken seriously. Requests were being kept at a volume that HR/legal/RHRhrcompliance teams could actually cope with.

For large businesses, that steady volume has more or less gone. Anyone can now type “write me a subject access request” into any free AI tool and, within seconds, you’ll get back something that reads like it was written by a professional – it cites Article 15 UK GDPR correctly, references the one-month deadline under Article 12(3) UK GDPR, and asks for everything from emails and Teams messages to WhatsApp messages held on personal devices, metadata and deleted files.

Some requests may use incorrect terminology and refer to legal authorities that do not exist or an individual may misunderstand the scope of the right of access, the fact that a request has been generated using AI does not change the individual’s underlying right of access.

This isn’t a small, occasional problem

Complaints processed by the Information Commission’s Office (ICO) are predominantly focused on SARs. The ICO’s most recent data set (which you can find here) shows that overwhelming majority of complaints it deals with cite the right of access as the primary reason for complaints.

What that means in practice for your compliance team is fairly simple: requests are getting bigger, they’re touching more systems, and they’re arriving more often – “what data do you hold on me” has turned into requests that try to cover every database, every custodian, and every exemption an organisation might try to rely on.

The important question is still: what personal data is actually within the scope of the request, and what reasonable and proportionate searches are required to find it?

Why AI-generated SARs are creating problems for employers

The difficulty is not necessarily that AI-generated SARs are legally different.

It is that they can be much easier to create, much broader in scope and much more difficult to process efficiently.

A request can potentially send your compliance team looking across multiple systems and custodians. This means considering information held across the following systems:

• HR and payroll systems;
• email accounts;
• Microsoft Teams;
• shared drives;
• case management systems;
• employee files;
• line managers’ records;
• mobile devices; and
• other systems or communication channels relevant to the request.

Your task is then to establish what information falls within the scope of the request, identify information relating to other individuals, consider applicable exemptions and restrictions, and carry out any necessary redaction.

Organisations only need to carry out reasonable and proportionate searches for relevant information when responding to a SAR. However, an organisation must be able to explain why a particular search would be unreasonable or disproportionate.

That is particularly important where a request is extremely broad.

A request for “everything you hold about me” does not automatically mean that you must search every conceivable system, mailbox or file without considering relevance and proportionality.

Equally, the size of a request alone does not necessarily make it excessive.

Our tip? Each request needs to be considered on a case-by-case basis.

SARs don’t necessarily stop at one request or email

Once a response goes back to the individual, some are simply pasting it straight back into the same AI tool and asking it to draft a follow-up – another request, a complaint, sometimes a referral to the ICO. It can carry on for a while, and each round takes just as long to deal with as the last.

This is a common theme in employee disputes. Many SARs now come from current or former staff mid-grievance, disciplinary or investigation, and staff data tends to be spread thinly across HR systems, line managers’ inboxes and Teams or WhatsApp threads, which makes it slower to pull together than most people expect.

More commonly, we are seeing SARs being used less as a genuine attempt to see personal data and more as pressure alongside a grievance, a tribunal claim, or a wider dispute.

How can companies equip themselves?

It can feel like the balance has tipped entirely towards whoever’s making the request. It hasn’t, not really. There are still tools companies can rely on:

1. Identify what is actually being requested -do not be distracted by the language used in the request. Where the scope is genuinely unclear, you can ask the requester for clarification.
2. Plan a reasonable and proportionate search – the Data (Use and Access) Act 2025 only requires you to undertake reasonable and proportionate searches. You don’t have to turn the whole organisation inside out because the request says so. You’re allowed to pause the one-month clock to ask for clarification where scope genuinely isn’t clear.
3. Requests that are manifestly unfounded or excessive can still be refused provided the reasoning is properly justified.
4. Consider exemptions, restrictions and third-party information. Finding the information is only part of the process. Once information has been identified, the organisation needs to consider what can be disclosed. This may involve identifying information relating to other people, legally privileged material or information subject to another applicable exemption or restriction. Redaction therefore needs to be carried out carefully and consistently.

None of that is complicated in theory. The trouble is doing it correctly, every time, inside a one-month window, when multiple requests land in the same week and on top of the day job.

More often than not, we see employers come up with reasons not to comply, which eats into the one-month statutory timeframe to respond.

How we can help?

Handling large volumes of SARs properly – without missing deadlines and without leaving gaps a complaint can exploit – is exactly what our SAR response service was built for.

In practice, that starts with working out what’s actually being asked for, which sounds obvious but is half the battle if you have been gifted a three-page AI-drafted request. From there it’s advising you on where and how to search – from email, Teams, HR systems to shared drives.

We can support you with the practical and legal aspects of responding to SARs, including:

• assessing the scope of a request;
• advising on clarification and proportionality;
• identifying appropriate search strategies;
• undertaking document review and redaction; and
• considering exemptions and legally privileged material;
• identifying and addressing third-party personal data;
• helping you respond within the applicable timeframe.

If you are dealing with a large, complex or employment-related subject access request, Maria Spencer can help you understand what needs to be done and manage the response.

Get in touch to discuss how Prettys’ DSAR response service can help take the burden off your teams.