How to handle AI-generated DSARs

Generative AI is making it much easier for people to create lengthy and highly detailed Data SubjectAn individual who can be identified or is identifiable from data. Access Requests (DSARs). Teams are now seeing more of these types of requests, often involving broader searches, with more difficult disclosure decisions to make, all within the same one-month deadline. 

However, the use of AI does not change an individual’s right of access, nor does it automatically give organisations grounds to limit or refuse a request. 

This blog explores how AI is impacting DSARs, what organisations can legally do when requests become difficult to manage, and how to strengthen your DSAR response processes. 

Key takeaway: AI-generated DSARs may be longer and more detailed, but the same rules apply. Focus on the personal dataInformation which relates to an identified or identifiable natural person. being requested, understand when you can clarify, extend, limit or refuse a request, and ensure your processes support a reasonable and proportionate response.  

• Why is AI making DSARs more challenging?
• Complying with AI-generated DSARs
• Managing difficult DSARs
• Preparing for AI-generated DSARs

Why is AI making DSARs more challenging?

Generative AI can help individuals create lengthy and highly detailed DSARs in a matter of minutes. It can identify different categories of personal data to request, specify systems or communication channels to search, suggest date ranges and search terms, and incorporate references to data protection legislation. 

However, depending on the prompt used, not all of this information will necessarily be relevant or accurate. An AI-generated request might include unnecessary search criteria, incorrect legal arguments, or requests for information that fall outside the right of access. 

As with any DSAR, you still need to determine what personal data falls within the scope of the request. Lengthy AI-generated instructions or inaccurate assertions may require additional explanation when responding to the individual.  

Do you have to comply with an AI-generated DSAR?

In short, yes. The use of AI to draft a DSAR does not change an individual’s right of access or the processA series of actions or steps taken in order to achieve a particular end. you should follow when responding. 

A lengthy or complicated request may require more work, but this doesn’t automatically make it manifestly unfounded or excessive. The threshold for refusing a DSAR on these grounds is high and applies in the same way, regardless of whether AI was used to create the request. 

It is also important not to make assumptions about why an individual has used AI. For some people, including neurodivergent individuals or those with special educational needs and disabilities (SEND), AI may help them formulate or communicate a request they might otherwise find difficult to express. 

You should therefore assess the substance of the request, rather than how it was created. Consider what personal data the individual is asking for, what you need to do to respond, and whether any legal provisions for managing particularly difficult requests apply. 

For lengthy AI-generated DSARs, it may help to break the request down into the personal data being requested and separate out anything that falls outside the right of access. This can also help identify anything that is unclear or may need clarification.  

What can you legally do when a DSAR becomes difficult to manage? 

A request being time-consuming or resource-intensive does not, on its own, mean that you can delay or refuse to respond. Depending on the circumstances, you may be able to ask for clarification, extend the response period, or, in limited cases, refuse to act on the request.  

Ask for clarification 

You can ask an individual to clarify their request, but only where this is reasonably required to respond. For example, where the request is unclear or you hold a large amount of information about them. 

Clarification may include suggesting a more limited date range or explaining how many documents may fall within the scope of their current request. 

If clarification is reasonably required, the response deadline can be paused from the date clarification is requested and resumes the day after it is received. However, you cannot force an individual to narrow the scope of their request. 

Conduct a reasonable and proportionate search

You are not expected to search indefinitely for every piece of information that might fall within a DSAR. Under UK data protection lawAny law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding restriction (as amended, consolidated or re-enacted from time to time) that relates to the protection of individuals with regards to the Processing of personal data., searches need to be reasonable and proportionate. 

The Data Use and Access Act 2025 (DUAA) clarified this position. What is reasonable will depend on the size and resources of an organisation, along with the volume of information the individual is seeking. 

For example, it may be disproportionate to search every email containing an employee’s name when responding to a DSAR about a disciplinary matter. A more targeted search of communications between those involved may be proportionate. 

You should be able to justify why you consider a particular search unreasonable or disproportionate.  

Extend the response period

You can extend the response period by up to two months if a request is particularly complex or the individual has submitted multiple requests. 

Complexity might involve confidentiality issues, the need for specialist legal advice, or where litigation is anticipated or ongoing. A large volume of information does not, by itself, make a request complex. 

If you extend the deadline, you should be able to explain why the request requires additional time and notify the individual within the initial one-month period. 

You should also seek to provide any information you can within the original timeframe.  

Refuse a manifestly unfounded or excessive request

You can refuse to act on a DSAR, or charge a reasonable fee, if it is manifestly unfounded or excessive.  

A request may be: 

• Manifestly unfounded if it is clearly made with no genuine intention of exercising the right of access, for example, where the sole purpose is to harass or disrupt 
• Manifestly excessive if it is clearly unreasonable, such as substantially repetitive or overlapping requests 

You must be able to demonstrate and explain why you consider the request manifestly unfounded or excessive.  

The threshold is high, so each request must be assessed on its individual circumstances. The fact that a DSAR is lengthy, burdensome or AI-generated is not, by itself, enough to meet this threshold. 

Read the ICO guidance on manifestly unfounded or excessive requests 

Download our white paper for further guidance on handling DSARs efficiently, managing searches and meeting response deadlines. 

Our dedicated DSAR team provides specialist support when you need extra capacity or expertise. Contact us to discuss your requirements. 

In case you missed it…

• A practical guide to identity verification for DSARs 
• Using AI for DSAR responses: What every organisation should know 
• How to explain AI-generated outputs in a DSAR response