What is a Reasonable and Proportionate Search?
If you’ve received a Data Subject Access Request, (DSAR) one of the first questions you’ll probably ask is, “How far do we actually have to go to find this information?”
This is one of the questions we’re asked most often. In practice, the law doesn’t expect organisations to search everywhere. It asks that the search is reasonable and proportionate to your organisation. This has different meanings for different organisations. Knowing where to drawn the line can save time and cost.
So what does a reasonable search actually look like?
We start by asking every organisation the same question. “Where is this person’s personal data most likely to be held?”
For a small business, personal data may exist within a handful of email accounts, a customer database and a shared drive. For a multinational organisation, the exercise may involve dozens of systems and archived records held across different jurisdictions.
Start with a search strategy
Before any searching begins, the organisation should have a plan in place and identify the systems most likely to contain relevant personal data. This requires a joint documented effort by those involved so; if later questioned by the requester or the ICO there is a logical answer. Once those searches have been completed, the volume and nature of the results will often determine the next steps.
What happens if the search returns a large volume of information?
The difficulty organisations often face is that they cannot accurately estimate the amount of work involved until the searches have been completed.
For this reason, many complex DSAR projects are priced in stages. Until the search results are available, it is often impossible to estimate how much review work will be required or whether the request is sufficiently complex to justify an extension of time.
In our experience, one of the most common issues we see is that the information returned is often out of scope and excessive. This is often due to search terms being too broad. We also see cases where financial and sensitive information of others is disclosed without realising.
One practical way to reduce the risk is to either have items separated onto different systems or password protect those sensitive items. This will add an extra layer of security if it was accidentally disclosed. Similarly, having a clear policy that limits the use of company devices and systems for storing personal information can significantly reduce the amount of irrelevant material that needs to be reviewed during a DSAR.
Managing a large DSAR?
Large DSARs often require structured searches, review and redaction before disclosure. Learn how our DSAR Response Service supports organisations managing high-volume requests here.
Can we ask the requester to narrow their request?
Yes, absolutely. Where a request is particularly broad, organisations can ask the requester whether they would be willing to clarify what information they are looking for or narrow the scope of the request. This is standard practice and individuals can be responsive to this ask. But keep in mind that they don’t have to.
Did you know, under the Data (Use and Access) Act 2025, an organisation can reasonably request clarification in order to identify the information being sought, the statutory time limit may be paused until the requester provides that clarification. Organisations should however record when clarification was requested and when a response was received.
When should you seek professional advice?
A common mistake we see is organisations leaving a DSAR until the last moment, without appreciating how much time may be needed to carry out searches, review documents, apply redactions and consider whether any exemptions apply.
Seeking legal advice early in the process can make a significant difference. It provides time to develop a structured search strategy, identify potential issues before they become problems and avoid unnecessary work. In many cases, this reduces both the pressure on internal teams and the overall cost of responding to the request.
Early advice can also place the organisation in a stronger position if its response is later challenged. Decisions about the scope of the search, the application of exemptions and any information withheld are more likely to be properly documented and supported, making it easier to explain and justify the organisation’s approach if the requester raises concerns or the ICO becomes involved.
If your organisation needs assistance, our DSAR Response Service provides practical, solicitor-led support throughout the search, review and response process.
Need help responding to a complex DSAR?
Our DSAR Response Service for UK Organisations supports organisations throughout the entire response process, from planning proportionate searches and reviewing search results to applying exemptions, carrying out redactions and preparing the final response.
Learn more about our DSAR Response Service →
Written by Clara Westbrook, solicitor and founder.
Speak to our team
Explore More Data Protection & Privacy Services
Our team have a deep understanding of the following areas of law and continue to add value to our clients’ businesses.
Latest Insights
- The GDPR Accountability Principle: From Paper to Practice
Accountability principle As a new consultant at Westbrook Data Protection Services, one of the first […] - Changes to employment law and the rise in Data Subject Access Requests
Changes to employment law and the rise in Data Subject Access Requests Employment Rights Act […]