Excessive and Manifestly Unfounded DSARs: Always on the Line
I’ve never refused a data subject access request (DSAR) as excessive or manifestly unfounded, even though I’ve been close more than once.When you move past first gut reaction and consider the test and circumstances, the reason refusals are so rare becomes obvious: the bar is deliberately high, and most “problem” DSARs don’t clear it.
Years ago, one of my earliest data protection roles involved handling DSARs — most of the day, every day. Nearly all of them were contentious, submitted by unhappy former employees searching for a “smoking gun”. I only ever came close to refusing a handful of requests, and those near-misses are worth sharing. Because the question always remains: is this excessive or manifestly unfounded?
Case Study 1 – An 800-Page DSAR Sent by Post: Was It Excessive?
I dealt with a request from a then-current employee, let’s call him Ben (not their real name), who wanted everything the organisation had on him since they started working there in the 1990s. This was more than two decades’ worth of information about Ben.
Although there was an underlying HR dispute related to more recent events, the request itself was framed broadly.
Ben also wanted everything as a hardcopy, sent to his home address. No, he didn’t want to narrow it down and insisted on paper copies.
I was very surprised but diligently searched for everything, de-duplicated results, found paper copies of all sorts of information.
At the end of the process, the DSAR report was 800 pages. I am not exaggerating because I personally compiled it.
I put the argument to the DPO that maybe this was excessive (we were a small team), or if not excessive, then surely worth an administrative fee. The DPO said no because we didn’t have a policy for this so it would be unfair to charge Ben on this one occasion.
In hindsight, the absence of a policy was almost beside the point. Charging a fee would still have required demonstrating that the request was excessive. Volume alone is rarely enough, but isn’t 800 pages requested on paper enough?
I moved on. Getting the report ready took a day - half a day for the assistant to print everything and another half a day for me to check everything is where it should be. We sent the response in a couple of boxes.
I didn't hear from Ben, but I doubt he got what he needed and actually benefited in any way from his right to have a copy of his data.
@iniguez on Unsplash
Case Study 2 – When the Requester Signals Disruption
My second case was with Ella. I was going through round 2-3 of “this is not everything” and me searching, when I saw a sentence from someone speaking on their behalf along the lines of: “We know this can go on, we can just keep submitting DSARs”.
Today, that sentence would immediately trigger consideration of the ICO’s guidance on manifestly unfounded requests, particularly where a requester: “explicitly states, in the request itself or in other communications, that they intend to cause disruption”.*
I pointed this out to the DPO, and yet, it was not grounds for refusal because this was a one-time comment. Instead, it just raised a red flag and if we saw something similar again, we were to consider refusal.
I dealt with the DSAR and responded as usual.
Managing Difficult DSARs Today
Would I refuse either request today? I might still struggle to justify it.
The new standard of “reasonable and proportionate search” certainly helps frame conversations, but it does not convert a wide request into an excessive one. A request covering a long employment history is not automatically disproportionate simply because it is inconvenient.
I, for example, was in a small team, and we never challenged requests because they were too much and we were too few doing everything.
The bar is high for a reason and the burden is on the organisation to make a case for a refusable request. The ICO says you should consider the context and specific circumstances. So, what should a team lead do when their small, exhausted team has yet another hard 30 days in front of them?
Document your reasoning.
Plan ahead, organise resources.
Manage internal and external expectations.
Separate frustration from evidence.
Take care of your team. I have written about data protection complaints and how they affect people.
Finally, remember that “almost excessive” is still answerable. Think of a game of tennis – a ball touching the line is still in, even if most of it looks/is out.
* ICO detailed on guidance on subject access requests, exemptions available at <https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/exemptions-when-can-we-consider-a-request-to-be-manifestly-unfounded-or-excessive/> accessed 12.02.26