UK subject access request statistics, with the share of published ICO completed cases involving Article 15, dated evidence about organisations’ workload, and the current response rules. Complaint figures measure disputes, not the total number of SARs made to UK organisations.
A subject access request (SAR or DSAR) lets an individual obtain their personal data and associated information, subject to applicable exemptions. This page calculates complaint shares from the ICO’s published completed-case extracts and uses its annual report for overall complaint volumes. Separate EY survey findings describe financial-services respondents’ experience in FY 2021–22.
Key facts and figures
- 48.6% of published ICO cases completed in Q1 2026/27 had an Article 15 provision as the primary issue — 11,731 of 24,132 cases.
- 40.7% was the equivalent share in the published Q4 2025/26 extract, using all Article 15 subcategories.
- 11,731 published completed cases concerned Article 15 in April–June 2026; this is not a count of SARs received by UK organisations.
- 51% of respondents to EY Law’s 2023 financial-services survey had received complaints about DSAR handling, based on FY 2021–22 experience.
- 88% of respondents in the same EY survey handled DSARs in-house.
- 60% of respondents reported an increase in DSARs in EY Law’s 2023 financial-services survey, which covered FY 2021–22.
- 33% of respondents to the EY survey had received bulk DSARs.
- 21,000 was approximately the Home Office’s backlog of SARs not answered within the statutory timeframe between March and November 2021, investigated by the ICO in 2022.
Figures were checked on 15 October 2026. The latest detailed ICO extract used here covers April–June 2026. Historical survey and enforcement examples are labelled with their original periods and should not be read as current UK-wide averages.
Is the right of access the ICO's most common complaint?
Article 15 provisions were the primary issue in 11,731 of the 24,132 unique cases in the ICO’s published Q1 2026/27 completed-case extract, or 48.6%. The calculation includes the general right-of-access code and every Article 15 subcategory, including providing a copy, sources of data and reasonable and proportionate searches.
The equivalent shares were 45.0% in Q2 2025/26, 43.8% in Q3 and 40.7% in Q4. These are shares of published completed cases, not complaint receipts or all SARs. Changing case selection, completion patterns and classification can affect comparisons.
| Period | Right-of-access cases | All completed complaint cases | Share |
|---|---|---|---|
| Q2 2025/26 (July–September 2025) | 4,216 | 9,361 | 45.0% |
| Q3 2025/26 (October–December 2025) | 3,786 | 8,645 | 43.8% |
| Q4 2025/26 (January–March 2026) | 12,946 | 31,799 | 40.7% |
| Q1 2026/27 (April–June 2026) | 11,731 | 24,132 | 48.6% |
Each row counts unique case references in the published quarterly extract, excluding headings and including all primary-reason codes beginning Article 15. Extract totals are not interchangeable with the annual report’s operational totals. The issue recorded in a complaint is not itself a finding of infringement.
A SAR does not require a lawyer, a particular form or the words subject access request. Organisations need a process for recognising verbal and written requests, finding the information and applying any relevant exemptions. The usual deadline is one calendar month, subject to the specific rules below.
For context, the ICO received 76,743 data protection complaints in 2025/26 and issued 62,211 outcome decisions. Those annual measures cover all complaint topics and differ from the published per-case extracts used for the Article 15 shares. A share of completed cases must not be multiplied by complaint receipts to estimate incoming SAR complaints.
How many DSARs do UK organisations receive?
There is no comprehensive official total of SARs received by all UK organisations in the sources used here. EY Law’s 2023 survey of more than 500 financial-services professionals found that 60% reported an increase in requests during FY 2021–22. This is dated sector research, not evidence that every organisation receives a particular monthly average today.
In that EY survey, 88% handled DSARs in-house. Work can involve several teams and systems, but the survey does not establish that manual processing alone causes missed deadlines. Organisations should track actual request volumes, staff time and response performance to plan their own resources.
The same survey found that 51% of respondents had received complaints about DSAR handling and 33% had received bulk DSARs. These figures describe the surveyed respondents; they are not percentages of all UK organisations or all requests.
How much does it cost to process a subject access request?
A SAR’s processing cost depends on the amount and location of relevant personal data, the searches needed, review and disclosure work, and any applicable exemptions. The reviewed official sources do not provide a current national mean cost per request, so an old vendor estimate should not be presented as a current standard tariff.
The table below sets out practical workload and charging considerations from ICO guidance. They help organisations estimate their own costs without assuming that every request takes the same number of hours or requires disclosure of every document mentioning the person.
| Work or charging issue | What to allow for | Current ICO guidance |
|---|---|---|
| Locating information | Reasonable and proportionate searches | Identify relevant systems and explain search decisions |
| Reviewing information | Case-specific staff time | Assess personal data, context and applicable exemptions |
| Information about others | Disclosure assessment and possible redaction | Consider consent and whether disclosure without consent is reasonable |
| Providing the first copy | Normally free of charge | Exceptions can apply to manifestly unfounded or excessive requests |
| Further copies | A reasonable administrative fee may apply | Assess the request and explain the fee |
| Response timetable | Usually one calendar month | An extension of up to two further months may apply for complexity or number of requests |
The right is to personal data and supplementary information, not automatically to whole documents. Redaction of other people’s information is not automatic either: the organisation must assess the relevant rights, consent and whether disclosure is reasonable.
Historical commercial surveys can be useful context when their sample and method are clear. They cannot establish a current national average, and rising request volumes do not by themselves prove that the cost per request has risen. Track both volume and effort locally.
How should organisations plan for employee and customer SARs?
Both employees and customers can exercise the right of access. An employee request may cover HR records and correspondence, while a customer request may span accounts, transactions and service interactions. The reviewed evidence does not support a current UK-wide ranking of which group sends the most requests.
A request can be valid even when connected with a grievance or litigation. Handle the data protection right on its own merits, using the applicable rules and exemptions, rather than refusing it merely because the person is also involved in a dispute.
Plan for the information systems and teams that requests are likely to involve. Clear ownership, retention schedules and an auditable response process help organisations deal consistently with requests from any group.
What happens if an organisation misses the SAR deadline?
A controller normally must respond without undue delay and within one calendar month. It may extend by up to two further months where necessary because of complexity or the number of requests, explaining the extension within the initial period. The following published ICO examples illustrate different SAR-handling failures:
- Home Office — the ICO’s September 2022 reprimand concerned just under 21,000 SARs not answered within the statutory timeframe between March and November 2021.
- Home Office — the same decision recorded that just over 3,000 unanswered SARs remained outside the legal time limit in July 2022.
- United Lincolnshire Teaching Hospitals — the December 2024 reprimand found that 32% of SARs were not answered within the statutory timeframe during March 2021–March 2022.
Enforcement has continued since. In December 2024 the ICO reprimanded United Lincolnshire Teaching Hospitals NHS Trust for failing to answer 32% of SARs within the statutory one calendar month (covering March 2021 to March 2022).
The ICO may issue advice, reprimands, enforcement notices or other regulatory action depending on the circumstances. A missed deadline does not automatically result in a fine or compensation. Individuals may complain and can seek a court remedy; compensation requires the relevant legal conditions, including damage or distress, to be met.
How does the Data (Use and Access) Act 2025 change SAR rules?
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. Its data protection changes are now in force, including provisions on reasonable and proportionate SAR searches and pausing the response period while reasonably necessary clarification is awaited.
- Clarification — where the statutory conditions apply, the response period can pause while the organisation reasonably waits for clarification needed to identify the information or processing covered by the request. This is not permission to delay every request automatically.
- Reasonable and proportionate search — organisations are required to conduct a reasonable and proportionate search for the requester's data, but are not obliged to search every conceivable location regardless of cost or effort.
Where identity information is reasonably required, the time limit starts once the necessary information is received; this is distinct from pausing for clarification. The usual one-calendar-month limit, the possible extension for complex or numerous requests and the rules on fees still need to be applied correctly.
Organisations should document when a request arrived, any justified identity or clarification request, and how the deadline was calculated. The changes do not remove the duty to respond without undue delay or allow an organisation to demand unnecessary information.
Frequently asked questions
What is the most common data protection complaint to the ICO?
Article 15 right-of-access provisions formed the primary issue in 11,731 of the 24,132 published cases completed in Q1 2026/27, or 48.6%. This includes all Article 15 subcategories and measures published completed cases, not new requests or all complaints received.
How much does it cost a business to process a subject access request?
There is no current national mean in the official sources reviewed here. Costs depend on the records, searches, review and disclosure work involved. Responses are normally free to the requester, subject to limited exceptions; a business’s internal processing cost is a different measure.
How many DSARs do companies receive?
Volumes vary by organisation. In EY Law’s 2023 financial-services survey, 60% of respondents reported an increase during FY 2021–22. That historical sector finding does not establish a current monthly average for all UK businesses.
Do employees or customers send more SARs?
The reviewed sources do not establish a current UK-wide ranking. Both groups can exercise the right, and the work involved depends on the records held and the request rather than the person’s label alone.
What happens if an organisation misses the one-month SAR deadline?
The requester can complain to the organisation and the ICO. Regulatory action and court remedies depend on the circumstances; a missed deadline does not automatically lead to a fine or compensation. Published reprimands against the Home Office in 2022 and United Lincolnshire Teaching Hospitals in 2024 show that systemic delays can prompt action.
How does the Data (Use and Access) Act 2025 change SAR response rules?
The law now expressly provides for reasonable and proportionate searches and a pause for reasonably necessary clarification when the conditions apply. If identity information is reasonably needed, the time limit starts when it arrives. The usual one-calendar-month deadline and other applicable safeguards remain.
Related guides
- ICO complaints statistics UK: volumes, topics and outcomes
- GDPR Fines UK: ICO Fine & Enforcement Statistics
- Data Breach Statistics UK: ICO Reports, Trends & Costs
- Individual rights under GDPR: a complete guide to data subject rights
- What is personal data under GDPR? Definitions and examples
Sources & references
- ICO — completed complaint cases, Q1 2026/27
- ICO — completed complaint cases, Q4 2025/26
- ICO — completed complaint cases, Q3 2025/26
- ICO — completed complaint cases, Q2 2025/26
- ICO — Annual Report 2025/26
- ICO — right of access guidance
- EY Law — 2023 financial-services DSAR survey, covering FY 2021–22
- ICO — Home Office reprimand, September 2022
- ICO — United Lincolnshire Teaching Hospitals reprimand, December 2024
- ICO — Data (Use and Access) Act 2025 commencement and guidance
Right of access is the ICO's number-one complaint topic — train your team to recognise a subject access request and respond correctly within the one-month deadline.
Explore the GDPR & Data Protection Course →
Mark writes about data protection, workplace compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.