How to answer a subject access request without exposing third parties

A former employee emails HR: “Please send me a copy of all personal data you hold about me, including emails that mention me.” That is a valid subject access request (SAR), and the clock starts on the day it arrives. Then someone opens the mailbox. The emails also contain colleagues, a customer who complained, the manager who handled a grievance and a supplier with a mobile number in the signature. Sending everything as it is would breach their rights. Blacking out everything would leave an empty response and invite a complaint to the ICO.

This article sets out a repeatable way to strike the balance: what the law requires, where third-party data hides, how to redact it properly and what to keep so you can show later that you got it right.

What the right of access requires, and where it stops

Article 15 of the UK GDPR (and of the EU GDPR, if you also serve people in the EU) gives individuals the right to confirmation that their data is being processed, supporting information about that processing, and a copy of their personal data. Article 15(4) adds the counterweight: the right to a copy must not adversely affect the rights and freedoms of others.

In the UK, the detail sits in the Data Protection Act 2018, Schedule 2, Part 3. You do not have to comply with a request if doing so would disclose information identifying another individual, unless that person has consented or it is reasonable to disclose without their consent. The Act lists factors to weigh, including any duty of confidentiality owed to the third party, any steps taken to seek consent, whether they are capable of giving it and whether they have expressly refused. The ICO's guidance stresses that the exemption is a balancing exercise, not a blanket excuse.

For organisations also subject to the EU GDPR, the Court of Justice confirmed in case C-487/21 (May 2023) that the copy must be a faithful and intelligible reproduction of the data, which can mean extracts or whole documents where that is essential for the person to understand their data, always taking the rights of others into account. In practice, you will often hand over the email itself, with other people's details removed.

Deadlines to put in the diary

• One month from receipt to respond (Article 12(3)).
• Up to two further months if the request is complex or you have received several from the same person; you must tell the requester, with reasons, within the first month.
• The response is normally free. A reasonable fee, or a refusal, is only possible for manifestly unfounded or excessive requests or further copies, and you must explain the decision.
• The ICO explains when the time limit can be paused, for example while you verify identity or ask the requester to clarify a very broad request.

Where third-party data hides

Names in the body of a letter are easy to spot. What slips through is usually in places nobody reviews because they “aren't content”:

• Email headers: people in CC and BCC, distribution lists, forwarding addresses and the trail of quoted replies at the bottom.
• Signatures with colleagues' direct lines, job titles and personal mobiles.
• Attachments: spreadsheets with columns about other staff, meeting notes listing attendees, fit notes mentioning family members.
• Comments and tracked changes in Word, speaker notes in slides.
• Metadata: author, last modified by, network paths that include a user name.
• Images and scans: someone else's ID card in the same file, a stamp with a name, a screenshot of a group chat.

A six-step method for preparing the response

1. Scope and search

Verify identity proportionately and only ask for clarification when you genuinely need it. Search every system holding the requester's data: email, CRM, payroll, case management, document stores. Record what you searched, where and with which terms. That note is your best defence if the response is later challenged.

2. Sort every document

Make three piles: documents only about the requester (disclose), documents not about them (out of scope) and mixed documents, which need work. For mixed documents, decide whether an extract is enough or whether the full document is needed for context.

3. Weigh what to withhold

Not every third-party detail is automatically withheld. Ask whether the requester already knows it, whether the person was acting in a professional capacity, and what harm disclosure could cause. A colleague's opinion about the requester is personal data of both: a common approach is to disclose what was said and withhold who said it where there is a real risk to them.

4. Redact irreversibly

A black box drawn on top of text removes nothing: the words stay underneath and can be copied out. Use a tool that deletes the content, flatten the result and remove the PDF metadata before sending. With scanned documents, check the invisible OCR text layer as well. The ICO's guidance on disclosing documents to the public covers the same traps, including hidden rows, worksheets and metadata.

5. Second-person check

Someone else opens the output, searches for the third-party names that appeared in the original and copies and pastes a few redacted areas. If anything comes back, return to step 4.

6. Deliver securely

If the request came electronically, reply in a commonly used electronic format unless asked otherwise. Use expiring links or password-protected files with the password sent separately, and avoid file names such as “SAR_John_Smith_complaint_from_Mary.pdf”.

Emails and attachments: the most common case

Most employee and customer SARs end up in the mailbox. Printing messages to PDF one by one and redacting by hand is slow and error-prone, because the same person appears dozens of times in different forms (“Laura”, “L. Green”, “lgreen@…”). Work from the original message (.eml or .msg) so you keep headers and attachments, apply one rule across the whole thread and treat every attachment as a separate document. Our guide on how to anonymise emails and attachments goes into more detail.

What to record so you can prove it

Accountability means being able to show that the request was handled properly. A minimal file per request should include:

Where Anonimatum fits

Anonimatum uses its own AI, running on EU servers, to detect names, organisations, addresses, phone numbers, ID numbers and bank details, and shows a preview for human review before applying redaction, which is irreversible. Since version 1.9.0 it handles .eml and .msg emails with attachments: headers, subject and body are anonymised, and attachments it cannot anonymise are never included in the output. A whitelist keeps the requester's own details visible, case files group all the documents for one request, and the group audit log records each operation without storing document names or content. See also our use case on handling subject access requests.