Use case · Use case · DPO
Handling subject access requests while protecting third parties
Anonimatum Team
In short
A subject access request (DSAR) must normally be answered within one month with a copy of the requester's data, but that copy must not adversely affect other people. The answer is to disclose everything and redact only what belongs to others.
A former employee asks for “all the data you hold about me”. A patient wants a copy of their records. A customer in the middle of a complaint asks for every email that mentions them. Under Article 15 of the UK GDPR and the EU GDPR, each of these is a subject access request (SAR or DSAR) with a statutory deadline and a less obvious risk: the requester's information is almost never alone. It sits alongside the names of colleagues, other patients, suppliers or witnesses.
This page explains what the law requires, how to organise a response on time and how to produce a copy that is genuinely useful to the requester without disclosing third-party data. It is practical guidance, not legal advice: for borderline cases, speak to your data protection officer.
What Article 15 requires you to provide
The right of access has three layers: confirmation that you process the person's data, access to that data through a copy, and supplementary information (purposes, categories, recipients, retention period, source if not collected from them, automated decision-making and the right to complain to the regulator, which in the UK is the ICO). The first copy is free; a reasonable fee is only allowed for further copies or, under UK rules, where a request is manifestly unfounded or excessive.
The ICO's right of access guidance expects searches to be thorough and proportionate, and says requesters do not have to explain why they want their data. In the EU, the European Data Protection Board's Guidelines 01/2022 take the same line. The Court of Justice ruled in C-307/22 (26 October 2023) that a patient is entitled to a first free copy of their medical records even if the purpose is unrelated to data protection, such as preparing a claim against a dentist.
Deadlines: one month, extendable by two
Article 12(3) sets one month from receipt. You can extend by a further two months if the request is complex or you have received several from the same person, provided you tell the requester within the first month and explain why. The ICO also accepts that the clock can be paused while you ask for clarification if you hold a large amount of information about the person. In the United States there is no general federal access right, but HIPAA-covered entities must act on a patient's access request within 30 days, with one 30-day extension (45 CFR 164.524).
Article 15(4) and information about other people
Article 15(4) says the right to obtain a copy must not adversely affect the rights and freedoms of others. In the UK, Schedule 2, Part 3 of the Data Protection Act 2018 sets out how to deal with third-party information: you may disclose it with consent, where it is reasonable to do so without consent, or otherwise withhold it. Neither regime lets you refuse a whole document by default. You weigh each item and, where possible, redact only what would harm someone else.
- Internal emails: names, addresses and signatures of colleagues who are not the requester.
- Health records: information supplied by relatives and details about other patients.
- Grievance or disciplinary files: identities of complainants and witnesses.
- Customer service threads: other customers' details in forwarded messages or screenshots.
- Trade secrets or intellectual property, which recital 63 also mentions.
A workflow that meets the deadline
From logging the request to disclosure
- Log the date of receipt and calculate the one-month deadline.
- Verify identity only where there is reasonable doubt, asking for no more than necessary.
- Identify sources: HR system, CRM, case management, mailboxes, shared drives, paper files.
- Extract relevant documents and emails, including attachments.
- Mark third-party data and apply the Article 15(4) / Schedule 2 balancing test, recording the outcome.
- Produce the copy with third-party data redacted or pseudonymised and stray metadata removed.
- Add the supplementary information required by Article 15(1).
- Send through a secure channel and keep evidence of the response.
Emails and attachments
Email is usually the hardest source: headers with dozens of recipients, forwarded chains and attachments in PDF, Word or Excel. Printing and redacting each message by hand takes days and leaves gaps, especially in headers and attachments. Exporting messages as .eml or Outlook .msg files and processing them in bulk is faster; see our guide to anonymising emails and attachments.
Redaction or pseudonymisation: keeping the copy readable
If a twenty-message thread arrives with every third-party name blacked out, the requester cannot tell whether two messages came from the same person. Consistent pseudonymisation fixes this: each third party always gets the same substitute (“Person A”, “Person B”), so the conversation still makes sense without revealing identities. Our glossary entry on pseudonymisation explains how it differs from anonymisation.
| Technique | When to use it | Risk to watch |
|---|---|---|
| Irreversible redaction | Data of no value to the requester (third-party phone numbers, addresses, ID numbers) | Text still sitting under a black box in the PDF |
| Consistent substitution | Email threads and case files with several people involved | Context that lets the requester work out who is who |
| Withholding a document | Documents that contain only other people's data | Justifying and recording the decision |
How Anonimatum helps
Anonimatum uses its own AI, running on servers in the European Union, to detect names, organisations, addresses, dates and amounts, and patterns for email addresses, phone numbers, IBANs and ID numbers. For a SAR, the key feature is the allow list: add the requester's name, email and identifiers so their data stays visible while everyone else's is hidden. You preview and review everything before applying it.
- Since version 1.9.0 it processes .eml and Outlook .msg emails: headers, subject, body and supported attachments, with the same substitute for the same data. Attachments that cannot be anonymised are never included in the output.
- Pseudonymisation replaces each third party consistently and stores the encrypted map in case you need to revisit the response.
- Scanned documents go through OCR, and Word, Excel and PDF output keeps its format, without leftover metadata.
- Case files with version history keep everything disclosed for one request together.
In healthcare the same workflow produces copies of patient records without relatives' or other patients' details, as described in anonymising medical records.
Frequently asked questions
Can I refuse to disclose a document because it contains third-party data?
Not automatically. Article 15(4) and, in the UK, Schedule 2 Part 3 DPA 2018 require you to weigh the interests involved and, where possible, disclose the document with only the third-party information redacted.
How long do I have to respond to a SAR?
One month from receipt, extendable by two further months for complex or numerous requests, as long as you tell the requester within the first month and explain why.
Can I charge for a subject access request?
Not for the first copy. A reasonable fee may apply to further copies or, in the UK, to manifestly unfounded or excessive requests. The CJEU confirmed in C-307/22 that the first copy of medical records is free.
Do I have to disclose emails that mention the requester?
The requester's personal data in those emails falls within the right of access. You normally disclose the relevant messages or extracts, redacting third-party information that should not be revealed.
Handling a steady flow of SARs?
See the plans and start redacting email threads and case files with third-party data protected and the requester's data left intact.