Evidencing a reasonable and proportionate SAR search

The Data (Use and Access) Act 2025 put into law something the ICO's guidance had long said: when someone makes a subject access request, you have to search for their personal data, but only as far as is reasonable and proportionate.

Section 78 of the Act adds to Article 15 of the UK GDPR that the data subject "is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search". The change is treated as having been in force since 1 January 2024.

The standard only protects you if you can show you met it. The ICO's guidance is direct: you "must be able to show why a search is unreasonable or disproportionate".

What the standard means

According to the ICO:

• You must make reasonable efforts to find and retrieve the information requested.
• You aren't required to run searches that would be unreasonable or disproportionate to the importance of providing access.
• To judge that, consider the circumstances of the request, the volume of information you'd need to search, any difficulties in finding it, and the fundamental nature of the right of access.
• Limiting one search doesn't end the job. You should still search for any other information within the scope of the request.

The last of those factors, the fundamental nature of the right of access, matters. "Reasonable and proportionate" is weighed against the importance of the right of access, not against convenience. It limits searches that would be out of proportion; it doesn't lower the standard for everything else.

What to record

A decision to limit a search is only as strong as the record behind it. For each request, we'd suggest keeping:

1. The request and any clarification. What was asked, when, and what the requester said about its scope. The ICO's guidance on time limits also suggests keeping a record of conversations about scope, and the dates you asked for and received further explanation.
2. Where you searched. Each system, mailbox, file share and set of paper records, with the date range and the search terms used.
3. Where you didn't search, and why. The factor that made it unreasonable or disproportionate (volume, difficulty, or both), with the evidence behind it: an estimate of how many items are involved and what retrieving them would take.
4. What you found and what you did with it. Volumes before and after removing duplicates, and what was disclosed, withheld or redacted, each with its legal basis.
5. Who decided. The name of the person who agreed each limit on the search, and when.

Make the record when you decide, not when a complaint arrives. A record written months later is much harder to rely on.

Why it matters more now

Since 19 June 2026, organisations have been legally required to handle data protection complaints made to them. Section 103 of the Act requires you to make complaints easy to submit, for example with a complaint form that can be completed electronically and by other means. You must acknowledge a complaint within 30 days and, without undue delay, respond to it and tell the complainant the outcome.

A requester who thinks your search fell short is likely to complain to you, and your answer will rest on the record. If the complaint goes to the ICO, the same record is your evidence.

Common mistakes

• Treating the standard as permission to search less by default. The fundamental nature of the right of access is one of the factors, and it weighs in the requester's favour.
• Deciding limits informally. A limit agreed in a conversation and never written down is hard to defend later.
• Excluding a source on assumption. An estimate of volume and effort is stronger evidence than a belief that a search would be too much.
• Forgetting the other sources. A reasonable limit on one system doesn't limit the search of the others.

How Smartbox helps

In Smartbox, every source is recorded as material comes in. Every redaction carries its legal basis and the name of the person who decided. The record of your search is assembled as the work happens, not reconstructed afterwards.

To see what that looks like on one of your own requests, book a demo. Or read what makes a disclosure defensible.