The Information Commissioner’s Office (ICO) has updated its guidance on subject access requests to reflect changes introduced by the Data (Use and Access) Act 2025 (DUAA).

The ICO notes that some of the relevant provisions of the DUAA to which the guidance relates are not yet in force. However, it has published the updated materials now so that organisations can make appropriate preparations in advance.

The guidance provides helpful clarification on the various parts of the DUAA that relate to subject access requests. For example, it explores the new ability of controllers to ‘stop the clock’ in order to ask for clarification about a request, explaining that clarification should be sought as soon as possible and that the clock will only stop where the clarification relates directly to the information requested, rather than to other matters such as the format of the response.

Also included is more detail about the new provision that codifies the requirement that an organisation responding to a subject access request only has to carry out ‘reasonable and proportionate’ searches for relevant information. The guidance makes clear that, in determining whether searches may be unreasonable or disproportionate, organisations should consider: (i) the circumstances of the request; (ii) the volume of information that may need to be searched in order to respond; (iii) difficulties in finding the information; and (iv) the fundamental nature of the right of access. It also reiterates that an organisation must be able to show why a search is unreasonable or disproportionate.

Finally, the guidance touches on new requirements that organisations must inform a data subject why a request has not been complied with, advise them of their right to complain both to the ICO and to the controller, and inform them  of their ability to enforce their rights before a court.

To read the update guidance in full, click here.