Redacting other people's information in a subject access request

Almost every subject access response includes someone else: a colleague in an email chain, a family member in a case file, a witness in an investigation. You can't withhold everything that mentions them, and you can't hand it all over either. Schedule 2, paragraph 16 of the Data Protection Act 2018 sets the test.

The test

You don't have to disclose information relating to another person who can be identified from it, unless:

• that person has consented to the disclosure; or
• it's reasonable to disclose it without their consent.

To decide whether it's reasonable, you must take into account all the relevant circumstances, including:

• the type of information that would be disclosed;
• any duty of confidentiality owed to the other person;
• any steps taken to seek their consent;
• whether they are capable of giving consent;
• any express refusal of consent.

Two points in the definitions are easy to miss:

• Information relating to another person includes information that identifies them as the source of the information.
• Someone counts as identifiable if they can be identified from the information itself, or from it together with other information you reasonably believe the requester has or is likely to get.

A name removed from a letter the requester will recognise may not be enough.

Staff acting in their professional role

Paragraph 17 deals with health professionals, social workers and education workers. In the circumstances it sets out, disclosing information that identifies them in their professional role is treated as reasonable without their consent. Health, social work and education staff named in records of that work are often in this position, so check paragraph 17 before redacting their names. Other staff fall under paragraph 16.

Redact, don't withhold

The test applies to the other person's information, not to whole documents. The requester is still entitled to their own personal data in the same document. The usual answer is to redact the details that identify the other person and disclose the rest.

Consider what the requester already knows. Information they already have, such as an email they wrote or a meeting they attended, may well be reasonable to disclose.

Where information is about both people and can't be separated, you still have to weigh the two interests using the paragraph 16 test.

Be consistent

Treat the same person the same way throughout the response. Decide once for each person, then apply that decision everywhere they appear. Inconsistent redaction across a bundle, a name removed on one page and left on the next, is one of the easiest failures to spot and one of the hardest to defend.

Make sure redactions are permanent. A black box drawn over text, or text coloured black, can often be lifted from the released file. Failure-to-redact incidents reported to the ICO rose from 333 in April to December 2019, when its data starts, to 886 in 2025 (ICO data security incident trends). Redactions need to be burned into the file, and the released copy checked.

Record each decision

For each redaction of another person's information, record:

• which person it concerns;
• the basis: no consent, and not reasonable to disclose after weighing the paragraph 16 factors;
• who made the decision, and when.

Since 19 June 2026, a requester who disagrees can complain to you directly, and you must handle the complaint. That record is your answer, and your evidence if the complaint goes on to the ICO.

How Smartbox helps

In Smartbox, every redaction carries its legal basis and the name of the person who decided. Redactions are burned into a new copy and checked again before anything is released.

To see it on a response of your own, book a demo. Our earlier posts cover evidencing a reasonable and proportionate search and the SAR clock since February 2026.