Not long ago, submitting a well-structured Data Subject Access Request (DSAR) took time. It required a working understanding of data protection rights, a sense of how organisations process information, and often a fair amount of persistence.
Now, it takes five minutes with a free GenAI account.
That shift hasn’t changed the law. But it has changed the experience of DSARs in a way that privacy teams are starting to feel quite acutely.
What we’re seeing isn’t a surge in bad-faith requests. It’s something more nuanced and more challenging. Requests are becoming easier to generate, more sophisticated in tone, and harder to deal with efficiently.
How is AI changing the DSAR landscape?
The barrier to entry is lower
In effect, AI is raising the baseline quality of incoming DSARs, resulting in fewer easy wins and more that require careful, end-to-end handling.
Templated escalation is a click away
With templated escalation a click away, individuals can generate follow-up emails, regulator complaints, and litigation-style letters that reference previous responses and highlight perceived gaps at a moment’s notice.
Even where the underlying issue is straightforward, the correspondence chain can quickly become long and operationally expensive to manage.
Campaign behaviour is easier to coordinate
What's actually changed (and what hasn't)?
The legal framework for DSARs
The Data (Use and Access) Act 2025 (DUAA) provides some useful clarity. In particular, it makes explicit that organisations are only required to conduct searches that are reasonable and proportionate, rather than exhausting every conceivable source. It also confirms that where further information is reasonably required to verify a requester’s identity, the one-month response period does not begin until that information has been received.
The new provisions don’t remove the obligation to respond, but they do give organisations clearer parameters around verification and the extent of the search required.
The operating environment
Requests are now faster to produce, broader in scope, and more confident in tone. In some cases, they are also more informed, drawing on publicly available information to infer likely systems, vendors, and data categories.
That creates a different kind of internal challenge.
A request that references specific systems or data types – even if only partially accurate – still needs to be addressed. That often means involving multiple teams to confirm what data exists, where it sits, and whether it falls within scope.
This is where the gap between the sophistication of incoming requests and the maturity of internal search, retention, and review workflows begins to widen.
In practice, that means teams are working harder to meet the same legal standard, often relying on manual effort where more structured, repeatable approaches are needed.
Common AI-assisted DSAR patterns
As these behaviours play out in practice, certain patterns are starting to emerge in how DSARs are framed, and how they impact the response process.
"Everything you hold about me" - expanded
This type of request isn’t new, but AI is changing what it looks like in practice. Generated versions often come with expansive definitions of personal data, alongside detailed lists of sources – emails, chat platforms, CCTV, call recordings, HR systems – and even metadata such as logs and audit trails.
On the surface, these requests appear thorough and well-considered. In practice, they can quickly expand into unnecessarily broad collection and review exercises if scope isn’t addressed early. The challenge for responders is to make defensible decisions about where and how far to search, rather than treating every system or data source named in a request as requiring an exhaustive exercise.
Disclosure-style requests
We’re also seeing DSARs that read more like disclosure exercises in litigation. Phrases such as “all internal communications referencing me” or “all notes, opinions, and assessments” are becoming more common, often extending to drafts and informal records.
These can fall within the scope of a DSAR, but they require careful balancing. Third-party data, confidentiality, and legal privilege all come into play, particularly in employee or dispute-related scenarios. Without a structured review approach, the volume of material – and the risk attached to it – can increase quickly.
Multi-jurisdictional mashups
Another emerging pattern is the blending of multiple legal frameworks into a single request. AI-generated drafts may combine UK GDPR and DPA 2018 language with non-UK concepts, including unrealistic response timelines or rights that don’t apply in the relevant jurisdiction.
Rather than rejecting these outright, they are often better treated as a starting point for clarification, confirming which rights are being exercised and under which legal framework they apply.
Precision follow-ups
Finally, there is the increasing precision of follow-up questions. Where responses rely on general language – “we searched relevant systems” – requesters can now generate targeted queries: which systems, which custodians, which date ranges?
These questions often draw directly on the organisation’s earlier response, identifying gaps or inconsistencies. In this context, ambiguity tends to invite further scrutiny, extending the correspondence and increasing the effort required to bring the request to a close.
How to respond without escalating the workload
The instinctive response to more sophisticated DSARs is to work harder – search more systems, review more data, provide more detailed explanations.
In practice, that approach doesn’t scale. What makes the difference is structure.
Start with structured scoping
A well-designed scoping process has become essential. When requests arrive broad, detailed, or loosely defined, early clarification can significantly reduce the volume of data that needs to be collected and reviewed.
The DUAA provides some breathing room here. If further information is reasonably required to identify the personal data or processing activity covered by a request, the response timeframe can be paused while the organisation waits for the requester to provide it.
That said, there are limits. Clarification shouldn’t be requested as a matter of course or simply as a way to buy more time, and organisations can’t force someone to narrow their request. If the requester maintains the original scope, the organisation still needs to carry out reasonable and proportionate searches. However, a constructive scoping conversation can help both sides arrive at a more workable request.
By providing clear options – time periods, business areas, specific systems, or priority questions – it’s possible to guide the requester toward a more focused scope without appearing obstructive. Done well, scoping improves both efficiency and the overall experience, shortening timelines rather than delaying them.
Be consistent in how you explain limits
Explanations around legal privilege, third-party data, and proportionality need to be clear, repeatable, and aligned across responses. Small variations in wording can quickly be exposed when correspondence is compared or extended, creating unnecessary challenges.
A standardised approach doesn’t just reduce risk, it also reduces effort, making it easier to respond confidently without revisiting the same decisions multiple times.
Design for auditability from the outset
DSARs should be handled with the assumption that the process may be scrutinised – by a regulator, or in a dispute.
Keeping a clear record of what was searched, when, and why makes it possible to demonstrate proportionality without reconstructing the process later. That includes documenting scope decisions, systems included or excluded, date ranges, and how exemptions were applied.
This is where a workflow-driven approach becomes valuable. When auditability is built in from the start, responses are easier to defend and significantly less costly to revisit.
Treat DSARs as a repeatable process, not an adhoc task
What ties all of this together is a shift in mindset.
DSARs are often handled as one-off exercises, shaped by the specifics of each request. That works at low volume, but it becomes difficult to sustain as requests become more frequent, more detailed, and more interconnected.
Treating DSARs as a repeatable process – supported by clear workflows, defined roles, and consistent outputs – makes it easier to manage volume without compromising quality.
This is where approaches drawn from eDiscovery can make a meaningful difference. Separating collection from review, applying consistent criteria, and maintaining a defensible audit trail all help to bring control to what can otherwise become a reactive process.
The real shift is operational
AI has changed how often, how quickly, and how rigorously organisations are being called upon to manage DSARs.
For DPOs and privacy teams, AI-assisted DSARs act as a stress test of existing processes. Where those processes rely on manual effort, informal knowledge, or inconsistent approaches, the strain becomes visible very quickly.
The organisations that cope best will be those that treat DSARs as an operational capability designed to scale, built for consistency, and grounded in defensible workflows.
Find out more about how Salient Discovery helps organisations handle complex DSARs.
