When Can You Stop Responding to a DSAR? Managing Endless Data Subject Correspondence

When is Enough, Enough? Managing Never-Ending DSAR Correspondence in the Age of AI

Data Subject Access Requests (DSARs) have always required careful handling. However, a growing challenge for organisations is not necessarily the initial request, but the seemingly endless correspondence that follows.

We’re increasingly seeing situations where a data subject receives a response to their DSAR and then responds with further questions, challenges, demands for clarification, or requests for additional investigations. Once resolved, another email arrives. Then another.

In some cases, organisations find themselves trapped in a cycle of correspondence that continues for weeks or months.

With the widespread availability of AI tools, generating detailed responses, objections, and follow-up questions has never been easier. While individuals absolutely have the right to challenge how their personal data is handled, organisations also need to understand where the line between reasonable engagement and disproportionate burden may lie.

So, when is enough enough?

There Is No Legal Requirement to Correspond Forever

A common misconception is that once a DSAR has been submitted, an organisation must continue responding indefinitely to every email related to the request.

The UK GDPR does not require controllers to engage in endless correspondence.

Instead, organisations must:

Conduct reasonable and proportionate searches.
Provide the information required under Article 15.
Explain the processing of personal data.
Address legitimate follow-up queries where necessary.

Once these obligations have been met, the law does not impose a duty to continue debating the response indefinitely.

The ICO Recognises That Requests Can Become Excessive

The Information Commissioner’s Office (ICO) acknowledges that organisations are not expected to accommodate requests that are:

Manifestly unfounded.
Manifestly excessive.
Repetitive in nature.

Although these provisions are often discussed in relation to the initial DSAR itself, they can also be relevant when considering repeated follow-up correspondence that covers ground already addressed.

The key question is whether the latest communication is seeking genuinely new information or simply revisiting matters that have already been thoroughly answered.

The Rise of AI-Generated Correspondence

Many privacy professionals are noticing a new trend.

A detailed DSAR response is issued.

Shortly afterwards, the organisation receives a lengthy challenge that appears highly technical, references multiple legal provisions, and requests further explanations on numerous points.

After these points are addressed, another response follows containing even more questions.

Often there is nothing wrong with this. Individuals are entitled to seek clarification and challenge organisations where appropriate.

However, AI tools can now rapidly generate extensive correspondence, regardless of whether there is a genuine issue requiring resolution.

This creates a risk that organisations devote significant resources to repeatedly answering slightly reworded versions of the same questions.

Importantly, the use of AI by the requestor does not change their legal rights, nor does it automatically make correspondence excessive. What matters is the substance of the request rather than how it was drafted.

Practical Questions Controllers Should Ask

Before deciding whether to bring correspondence to a close, consider:

Has the original request been fully answered?

Ensure all relevant searches have been completed and all required information has been provided.

Is new information actually being sought?

Review whether the latest communication raises genuinely new issues or simply rephrases previous concerns.

Have explanations already been provided?

Controllers should be cautious about repeatedly providing the same explanations where nothing materially new has been raised.

Is the burden becoming disproportionate?

Assess the time, resources, and impact associated with continued engagement.

Documenting this assessment can help demonstrate accountability if challenged later.

Could there be an underlying complaint?

Sometimes a data subject is not seeking access to personal data at all. Instead, they may be unhappy with an outcome, disciplinary process, service issue, or business decision.

DSAR rights should not be confused with a general right to debate or appeal organisational decisions.

A Practical Approach

Where an organisation believes it has fully addressed the request, it may be appropriate to write:

We believe that we have fully responded to your rights request and subsequent queries. Unless you raise a new data protection issue or identify specific personal data that you believe has not been addressed, we do not intend to provide further responses on matters already considered. If you remain dissatisfied, you have the right to raise concerns with the Information Commissioner’s Office.

This approach demonstrates reasonableness while avoiding an endless exchange of correspondence.

Documentation Is Critical

Before closing down further discussion, organisations should ensure they have documented:

The original request.
Responses provided.
Clarifications supplied.
Internal assessments.
Reasons for concluding that further correspondence would be repetitive or excessive.

If the ICO becomes involved, a well-documented decision-making process is likely to be far more important than whether the organisation sent one extra email.

Final Thoughts

Data protection rights are fundamental and organisations should always engage constructively with individuals exercising those rights.

However, compliance does not require endless correspondence.

As AI makes it easier to generate increasingly detailed challenges and follow-up questions, controllers should focus on the substance of the issues being raised rather than the volume of communications being received.

The objective is not to stop engaging with data subjects. It is to ensure that engagement remains proportionate, reasonable, and focused on the rights that the legislation is designed to protect.

Frequently Asked Questions

Can a controller refuse to answer repeated DSAR questions?
Yes, where the issues raised have already been fully addressed and no new personal data or data protection concerns are identified, organisations may decide that further correspondence is excessive or repetitive.

Does AI-generated correspondence give individuals additional rights?
No. The use of AI to draft responses does not alter a data subject’s rights under UK GDPR. Organisations should focus on the substance of the request rather than how it was created.

What does the ICO say about excessive requests?
The ICO recognises that organisations are not required to comply with requests that are manifestly unfounded or manifestly excessive, provided they can justify their decision.

Should organisations document decisions to stop responding?
Absolutely. A clear audit trail showing the request, responses provided, and rationale for ending correspondence is essential if the matter is later reviewed by the ICO.

Need more guidance on how to properly manage DSARs?

Speak to GRC Hub about our DSAR fulfilment solution or DPO-as-a-Service.

Governance Risk & Compliance Hub LIMITED