Using Artificial Intelligence (AI) to Help You Make a Subject Access Request (SAR)
What is AI?
We recognise that some individuals may choose to use Artificial Intelligence (AI) tools, such as ChatGPT, Copilot or other online writing assistants, when preparing a Subject Access Request (SAR). These tools can help organise thoughts, improve spelling and grammar, or provide a structure for making a request.
We will not refuse or treat requests differently because AI has been used. However, regardless of how a request is prepared, requests that clearly identify the personal data being sought are often easier to understand and process.
Why it is important to be clear
A clear request helps us understand what information you want and allows us to carry out reasonable and proportionate searches for your personal data.
In order to process your request, we may require the following:
- What information you are looking for
- Relevant dates or time periods
- Which departments, services, or teams may hold the information
- Whether you are looking for specific emails, letters, reports, records, or other documents
- Any other details that may help us find your personal data
You do not need to quote laws or use legal language. Simply telling us what information you would like is usually enough.
What a SAR Gives You
A SAR provides a right of access to personal data. It does not provide a right to access every document, record, email or piece of information held by an organisation.
Organisations are required to conduct reasonable and proportionate searches for personal data falling within the scope of a request. However, a SAR does not require organisations to:
- Every document held by an organisation
- Information that is not your personal data
- Answers to questions
- Explanations or justifications for decisions
- New reports, summaries, or investigations
- Changes to your records
- Information that belongs to someone else
- Information that is protected by law or exempt from disclosure
In some cases, information may need to be redacted or withheld to protect other people's privacy or because a legal exemption applies.
Audit Trails and Metadata
Where this information contains your personal data, we will consider it as part of your request.
However:
- Audit logs often contain information about staff or other individuals, which may need to be removed before disclosure.
- Metadata and technical system information are not usually personal data and are therefore not normally disclosed as part of a SAR.
If you do use AI tools to make a SAR
AI can sometimes make requests much broader than intended by asking for:
- Explanations of decisions
- Answers to questions
- Investigations into complaints
- New reports or summaries
- Information that is not personal data
- Structuring information in unclear or unhelpful ways
- Not following organisational requirements for submitting a SAR
These types of requests generally fall outside the scope of a SAR and may mean we need to contact you for clarification, which could delay your request.
AI tools do not know the specific details of your situation and can sometimes:
- Provide inaccurate information
- Refer to outdated guidance or legislation
- Misunderstand data protection law
- Suggest requests that fall outside the scope of a SAR
Our advice when using AI to draft a SAR
If you use AI to help draft your SAR:
- Check the wording carefully before submitting it
- Make sure it reflects what you actually want
- Keep the request focused on your personal data
- Remove requests for explanations, opinions, or investigations
- Include relevant dates, departments, or services where possible
- Ensure your request is clear, specific, proportionate, and reasonable