From Intake to Secure Delivery: A 10-Step Workflow for Stress-Free DSAR Management

For a UK Data Protection Officer (DPO), the Subject Access Request (SAR) is often the most significant drain on operational resources. With the implementation of the Data (Use and Access) Act 2025 (DUAA) in early 2026, the landscape has shifted. While the new legislation introduces welcome pragmatism regarding "reasonable and proportionate" searches and the ability to "stop the clock," the core challenge remains: how to process vast quantities of unstructured data without missing the 30-day deadline or risking a third-party data breach.

The average cost of a manual SAR in the UK has now climbed to approximately £1,200. This is not due to the complexity of the law, but the sheer friction of manual review. To move from a state of "compliance panic" to "operational excellence," organisations must adopt a structured, automated workflow.

Below is the definitive 10-step framework for managing DSARs in the 2026 regulatory environment.

1. Identity Verification and "Stopping the Clock"

The statutory one-month clock no longer begins the moment an email hits your inbox. Under the DUAA 2025, the period only commences once you have received the request and obtained any reasonably required proof of identity. Use this window to ensure the requester is who they say they are, preventing the accidental disclosure of personal data to a fraudulent actor.

2. Immediate Scoping and Clarification

If a request is "manifestly unfounded or excessive"—or simply too broad (e.g., "send me everything you have")—you can now formally pause the clock. By asking the requester for clarification on specific timeframes or document types, you ensure your search is targeted. However, the ICO warns that you cannot use clarification as a stalling tactic; it must be genuinely necessary to fulfil the request.

3. Executing "Reasonable and Proportionate" Searches

The 2026 ICO guidance codifies that you are not required to check every single backup tape or obscure archive if the effort is disproportionate to the benefit of the data subject. Focus your search on primary data stores: email servers (PST archives), CRM systems, and unstructured document repositories.

4. Aggregating Unstructured Data

The most significant bottleneck occurs here. Data rarely lives in neat folders. It is buried in Slack threads, email chains, and scanned PDFs. Collect these into a centralised, secure processing environment. If you are handling sensitive media, ensure your processing environment uses AES-256 encryption to maintain a defensible audit trail from the outset.

5. Automated PII Discovery

Manual "Ctrl+F" searches are no longer sufficient for modern data volumes. Utilise Al-powered discovery tools to automatically flag Personally Identifiable Information (PII) such as names, NI numbers, home addresses, and financial details. This step transforms the DPO's role from "data hunter" to "data validator."

6. Applying Legal Exemptions

Not everything discovered is disclosable. You must filter for legal professional privilege, management forecasting, and—most importantly—the rights of third parties. The UK GDPR requires a balancing test: is it reasonable to disclose third-party data without consent? If the answer is no, redaction is mandatory.

7. Irreversible Redaction (Not Just "Black Boxes")

A common pitfall is using standard PDF editors to draw black rectangles over text. In 2026, "false redactions" are a major source of ICO reprimands. If the underlying code or OCR layer remains, the data is not redacted. You must use a tool that performs true irreversible redaction, destroying the data at the code level. For organisations dealing with multimedia, this includes blurring faces in CCTV footage using automated computer vision.

8. The "Human-in-the-Loop" Quality Gate

While Al can handle 90% of the heavy lifting, the final accountability rests with the Data Controller. A senior reviewer must perform a "spot check" or a final pass of the redacted preview to ensure context-specific nuances (like a name used as a verb) haven't been missed. This maintains your "User Duty of Care" as required by the ICO.

9. Generating the Disclosure Package

Once redacted, the data must be presented in a concise, transparent, and intelligible format. This should include the "Supplementary Information" required by Article 15, such as the purposes of processing and the retention periods. Ensure that your final export is a clean, flattened file with all metadata and revision histories scrubbed.

10. Secure Delivery and Automated Purging

Sending a password-protected ZIP file via email is increasingly frowned upon for high-risk disclosures. Use a secure, encrypted portal for delivery. Finally, to adhere to the principle of Data Minimisation, ensure your redaction environment does not become a "shadow archive." Use a system with a 24-hour automated deletion cycle to purge the raw data once the redacted package is generated.

Conclusion

The 2026 DSAR environment rewards organisations that prioritise architectural transparency and automation. By following this 10-step workflow, you don't just meet the 30-day deadline; you reduce the "cost-per-request" and eliminate the risk of a secondary data breach during the disclosure process.