What is a Reasonable and Proportionate Search?
If you’ve received a Data Subject Access Request (DSAR), one of the first questions you’ll probably ask is, “How far do we actually have to go to find this information?”
This is one of the questions we’re asked most often. The law requires organisations to make a reasonable and proportionate search; it does not require them to search every conceivable location regardless of whether relevant personal data is likely to be held there. The appropriate scope depends on the circumstances, so a documented search strategy is essential.
So what does a reasonable search actually look like?
We start by asking every organisation the same question. “Where is this person’s personal data most likely to be held?”
For a small business, personal data may exist within a handful of email accounts, a customer database and a shared drive. For a multinational organisation, the exercise may involve dozens of systems and archived records held across different jurisdictions.
Start with a search strategy
Before searching begins, identify the systems, custodians, date ranges and search terms most likely to locate the requested personal data. Record who agreed the approach and why each source was included or excluded. If the requester or the ICO later questions the search, the organisation can then explain the decisions it made. The volume and nature of the results will help determine the next steps.
What happens if the search returns a large volume of information?
Organisations often cannot estimate the review work accurately until initial searches have been completed, so complex DSAR projects may need to be planned and priced in stages.
Search results frequently include irrelevant material or third-party information because the terms are too broad. Use an iterative review process: test the search terms, separate in-scope and out-of-scope material, identify third-party and confidential information, and refine the searches where appropriate.
Protect working copies and final disclosures with suitable access controls, but do not treat password protection as a substitute for reviewing and redacting information that should not be disclosed. Clear policies on business-system and device use can also reduce the amount of irrelevant material that has to be reviewed.
Managing a large DSAR?
Large DSARs often require structured searches, review and redaction before disclosure. Learn how our DSAR Response Service supports organisations managing high-volume requests here.
Can we ask the requester to narrow their request?
You may ask for clarification where you process a large amount of information about the requester and clarification is reasonably required to identify the information sought. A requester is not obliged to narrow a valid request merely to make it easier to handle, and the organisation should begin work on information it can already identify.
Under the Data (Use and Access) Act 2025, the response period may pause where clarification is reasonably required to identify the information sought. Record when clarification was requested and received, and follow the current ICO guidance when calculating the revised deadline.
When should you seek professional advice?
A common mistake we see is organisations leaving a DSAR until the last moment, without appreciating how much time may be needed to carry out searches, review documents, apply redactions and consider whether any exemptions apply.
Seeking legal advice early in the process can make a significant difference. It provides time to develop a structured search strategy, identify potential issues before they become problems and avoid unnecessary work. In many cases, this reduces both the pressure on internal teams and the overall cost of responding to the request.
Early advice can also place the organisation in a stronger position if its response is later challenged. Decisions about the scope of the search, the application of exemptions and any information withheld are more likely to be properly documented and supported, making it easier to explain and justify the organisation’s approach if the requester raises concerns or the ICO becomes involved.
If your organisation needs assistance, our DSAR Response Service provides practical, solicitor-led support throughout the search, review and response process.
Need help responding to a complex DSAR?
Our DSAR Response Service for UK Organisations supports organisations throughout the entire response process, from planning proportionate searches and reviewing search results to applying exemptions, carrying out redactions and preparing the final response.
Learn more about our DSAR Response Service →
Written by Clara Westbrook, solicitor and founder.
Speak to our team
Explore More Data Protection & Privacy Services
Our team has a deep understanding of the following areas of law and continue to add value to our clients’ businesses.
Latest Insights
- The GDPR Accountability Principle: From Paper to Practice
Accountability principle As a new consultant at Westbrook Data Protection Services, one of the first […] - Changes to employment law and the rise in Data Subject Access Requests
Changes to employment law and the rise in Data Subject Access Requests Employment Rights Act […]