Same right, new author: the ICO’s guidance on AI-assisted SARs

Anyone who handles data subject access requests (“SARs”) will probably have seen one by now: a four-page letter quoting laws from three different countries, asking for “all metadata, audit logs and backup records” and perhaps citing a case that nobody can find. It reads as though it came from a chatbot, and in all likelihood it did.

The ICO has now published guidance on these “AI-assisted SARs”, and its headline message is that the law hasn’t changed: a request isn’t invalid simply because AI helped to write it, and it must be treated in the same way as any other SAR. Anyone hoping the regulator would offer a way out will be disappointed, but the guidance is more helpful than it first appears, as it confirms a number of things organisations can do when an AI-drafted request arrives.

Stop reading the footnotes

One of the most useful lines in the guidance is also one of the easiest to miss: organisations don’t need to spend time working through legal references or other details that are inaccurate or irrelevant. What matters is whether the person is clearly asking for their personal information and, if so, what information they want.

In practice, this means a long AI-generated request can often be treated as a covering letter wrapped around a much shorter core request, which remains valid as long as the person clearly wants their information, however much made-up case law or misquoted legislation surrounds it. The real work lies in finding that core, rather than in rebutting every confident but mistaken legal claim along the way.

Long is not the same as complex

Many will hope that a long AI-generated request justifies the two-month extension available for complex requests, but the ICO rules that out. A SAR is not complex just because it’s long, unclear, convoluted or full of legal references, and even a large volume of information doesn’t make a request complex on its own.

What still counts is genuine practical difficulty, such as information that is hard to locate, extensive consideration of exemptions, third-party or sensitive data, the need for specialist advice, or several rights requests made at the same time. That last example is particularly relevant, since AI-drafted requests often bundle access requests, erasure demands and service complaints into a single document. Where an extension is justified, the requester must be told why.

The lesson is to base any decision to extend on the substance of the request, because “it was very long” is unlikely to stand up if the ICO later asks.

You set the search, not the prompt

AI-drafted requests often tell the organisation where to look, listing particular datasets, backups, CCTV and call logs, and sometimes even platforms the organisation doesn’t use. The guidance is clear, however, that it is for the organisation, not the requester, to decide the parameters of a reasonable and proportionate search.

That isn’t permission to narrow requests quietly, and organisations should not limit searches or make assumptions about what the person wants without consulting them. The ICO also says organisations should record their decisions on scope, including whether they asked for the requester’s views, what they included or excluded, and why. If a complaint follows, that record is likely to be the most valuable evidence available, and a short note made at the time is far easier than trying to reconstruct the reasoning months later.

Metadata: neither everything nor nothing

“Including all metadata” has become a stock phrase in AI-generated requests, and the ICO takes a balanced position on it. A request for “all of my personal information including metadata” doesn’t automatically require a search of every category of system-generated audit data, but where the person asks for specific metadata, or metadata is reasonably likely to contain relevant personal information, it needs to be considered.

The guidance also points out that people understand “metadata” in different ways, so it may be worth asking what they mean. This point deserves more attention than it is likely to get: access logs, call records, working patterns and GPS tags in photos can all identify individuals, including third parties, and metadata that identifies the requester falls within scope. Organisations that have never mapped what their systems record about access and activity may find that this is where AI-assisted SARs expose them most.

Talk to people, but don’t make them rewrite the request

A recurring theme of the guidance is, in effect, to pick up the phone to the requester. The ICO encourages informal contact to explain what information is held and what a reasonable and proportionate search involves, and to help the person frame their request. It even confirms that organisations can tell someone that AI seems to have confused their request or misstated the law.

There is a limit, though. Organisations can ask for clarification where it is reasonably required, and the clock stops while they wait, but they can’t make someone narrow the request or rewrite it to exclude information. The distinction matters: a conversation aimed at helping the requester is encouraged, whereas one aimed at shrinking the response is a risk.

Informal contact will not always be the right approach, however. Where litigation is underway or in prospect, or the SAR forms part of a wider grievance or dispute, an unscripted conversation with the requester may be neither appropriate nor desirable. It can also create evidential difficulties: what was said on an unrecorded call may later be disputed, or a passing comment relied on. In those cases, it is usually safer to keep communication in writing and to make sure any clarification request is clearly documented.

The ICO also notes that people often turn to AI because they don’t know how to make a SAR, or because they believe formal, assertive language will be taken more seriously, so an aggressive tone may say more about the tool than about the person. Approaching the requester with that in mind tends to lower the temperature, and often the workload as well.

The real risk may be fraud

Arguably, the data protection risk that deserves most attention is not the lengthy genuine request but the fake one. The ICO warns that bad actors may use AI to create false ID or letters of authority in order to obtain someone else’s data, and that where a letter of authority looks AI-generated, organisations should contact the individual directly. Correspondence addresses, including those of third-party representatives, should be checked against the details on file, and the organisation remains responsible for security even if the request contains incorrect details.

A convincing letter on headed paper from a “representative” therefore offers much less reassurance than it once did, and verification steps that might previously have seemed overcautious now look like simple good sense.

What about the vexatious ones?

Using AI doesn’t, by itself, make a request manifestly unfounded or excessive, and nor does the fact that a large amount of information has been requested. However, if a request is clearly malicious, abusive or designed to cause disruption, that may support refusing it or charging a fee, and the ICO is clear that using AI doesn’t remove the person’s responsibility for the content. As always, any reliance on these provisions must be justified.

Getting ahead of it

The ICO’s practical suggestions point towards designing the process rather than simply reacting to requests. They include clear guidance on how to make a SAR with a point of contact for those who want help, training staff so they aren’t intimidated by long requests, and publishing optional example prompts or templates. Requesters can also be reminded to check AI-drafted requests before sending them, and warned against putting sensitive personal information into AI tools.

The reasoning is sound: if making a request is simple, fewer people will feel they need a chatbot to make it sound serious. A clear page explaining how to make a SAR may now be one of the cheapest ways of keeping requests manageable.

The bottom line

The guidance doesn’t create new rules, and it says as much: no special exemptions apply to AI-assisted SARs. Its value lies in setting out what organisations can do with confidence, namely ignore made-up law, decide the scope of the search, ask sensible questions and say when AI has muddied a request. What they can’t do is treat the involvement of AI as a reason to not comply. The organisations that cope best are likely to be those that have documented their decisions, mapped their metadata, tightened their identity checks and made their SAR process simple to use.

If you would like to discuss how current or future regulations impact what you do, please contact Olivia Ward, Hamish Corner or any other member in our Technology team.