Artificial intelligence is changing not only how organisations process personal data, but also how individuals exercise their information rights.

The Information Commissioner’s Office (ICO) has published guidance for organisations receiving subject access requests (SARs) that have been written or generated using AI tools. The guidance responds to a growing practical issue: generative AI can help individuals produce requests that are considerably broader, and more complicated than necessary.

These requests may contain repetitive wording, reference to irrelevant or non-existent material, or inaccurate legal claims. However, the ICO’s central message is clear: the use of AI does not, by itself, make a subject access request invalid.

Organisations must continue to identify and respond to valid requests in accordance with the UK GDPR, while applying established subject access principles confidently and proportionately.

What is an AI-generated subject access request?

Individuals increasingly use generative AI tools to help draft correspondence, including requests to exercise their data protection rights.

This can make those rights easier to exercise. It may be particularly helpful for someone who is unfamiliar with data protection law, has difficulty expressing a request or wants assistance articulating complex concerns.

However, AI-generated correspondence can also create practical difficulties. A request might:

• be unusually long or repetitive;

• ask for every piece of information held by an organisation;

• refer to non-existent ICO decisions or case law;

• demand information that does not fall within the right of access; or

• use authoritative language that makes the request appear legally sophisticated, even where its content is unclear.

The important point is that the wording or apparent origin of the request is not decisive. Organisations should focus on its substance and determine whether an individual is asking for access to their personal data.

Does the use of AI make a request invalid?

No. Using AI to draft a request is comparable to using a template, an online form, or assistance from another person.

A SAR does not need to mention the UK GDPR, the Data Protection Act 2018, or the phrase “subject access request”. It can be made verbally or in writing, including through social media. An organisation must recognise a request where an individual is asking for access to their own personal information.

This remains the case where the request:

• appears to have been produced by an AI tool;

• contains irrelevant or inaccurate statements;

• misunderstands the extent of the right of access; or

• includes demands the organisation is not legally required to meet.

  
  

A poorly drafted request may still be a valid SAR. Equally, professional or legalistic wording does not expand the individual’s rights or alter the receiving organisation’s obligations.

Organisations should therefore avoid becoming distracted by the style of the correspondence. The first task is to identify what personal data the individual is seeking and separate that request from any associated complaint, question or demand.

Dealing with unclear or very broad requests

AI tools can turn a relatively straightforward concern into a request covering extensive periods, systems, individuals and categories of information.

Where an organisation processes a large amount of information about a person, it may ask the individual to specify the information or processing activities to which the request relates. Clarification can be particularly useful where an AI-generated request contains several overlapping or contradictory demands.

However, clarification should not become an obstacle to exercising the right of access. Organisations should explain what information would help them conduct a reasonable and proportionate search, rather than simply asking the individual to narrow the request.

They should also avoid assuming that a broad request is automatically “manifestly excessive”. That remains a limited ground for refusing a request or charging a reasonable fee. The fact that AI has enabled someone to produce a lengthy request will not, without more, satisfy the relevant legal threshold.

The ICO confirms that organisations must undertake a reasonable and proportionate search for the requested information. Requests may only be refused where an exemption or restriction applies, including where a request is manifestly unfounded or excessive.

Inaccurate legal claims do not need to be accepted

Generative AI tools can provide convincing but incorrect answers. This includes invented legal authorities, inaccurate quotations and misleading descriptions of an organisation’s obligations.

Organisations should not accept those assertions without checking them. The individual is entitled to their personal data and the supplementary information required by the UK GDPR. The right of access does not necessarily entitle them to:

• every document in its original form;

• information that is not their personal data;

• an explanation of every business decision;

• answers to general questions about the organisation;

• the creation of information that does not already exist; or

• compliance with deadlines invented by an AI tool.

Appropriately trained staff should distinguish between the rights actually provided by data protection law and additional demands contained in the request.

Existing time limits still apply

The usual statutory timetable applies regardless of whether AI was used to prepare the request. Organisations must respond without undue delay and normally within one month of receiving the SAR.

That period may be extended by up to a further two months where necessary because the request is complex or the individual has submitted a number of requests. If an extension is required, the individual must be informed within the initial one-month period.

An organisation may also need sufficient information to confirm the requester’s identity. Identity checks should be necessary and proportionate to the circumstances, rather than imposed automatically.

These requirements make early triage important. A request should be passed promptly to the relevant data protection or information governance team, even where it initially appears to be a complaint or has been sent to an unexpected part of the business.

Can organisations use AI to respond?

The arrival of AI-generated SARs may encourage organisations to use similar tools to review requests or prepare responses. That approach requires considerable care.

Entering a request, search result or proposed disclosure into a public generative AI service may involve sharing personal data, confidential information, or legally privileged material with a third party. It could also create accuracy, security, retention and international-transfer issues.

AI-generated output may omit important information, apply exemptions incorrectly or disclose information relating to another person. Human review is therefore essential.

Before using an AI system as part of the SAR process, organisations should consider:

• what information will be entered into the system;

• who provides and operates the tool;

• whether submitted information is retained or used to train the model;

• where the information is processed;

• whether appropriate contractual and security safeguards apply; and

• how the organisation will verify the accuracy and completeness of the output.

AI may assist with administration, document classification or identifying potentially relevant material, but responsibility for complying with the UK GDPR remains with the organisation.

Practical steps for organisations

The ICO’s guidance provides a useful opportunity to review existing SAR procedures. Organisations should consider whether they:

• train customer-facing staff to recognise a SAR regardless of how it is worded;

• have an effective process for triaging requests containing complaints and unrelated demands;

• know when and how to seek clarification;

• apply the “manifestly unfounded or excessive” test carefully and document the reasons for any decision;

• verify legal claims and citations rather than relying on the requester’s wording;

• maintain clear records of searches, decisions, exemptions and correspondence;

• have assessed whether employees are using generative AI during the SAR process; and

• provide approved tools and clear rules governing the use of AI with personal or confidential information.

The key is not to create a separate legal regime for AI-generated requests. Instead, organisations should ensure that their existing subject access processes are sufficiently clear, well governed and resilient to deal with requests that may be longer or more complicated.

A reminder to focus on substance

AI can make correspondence appear more complex than the issue it contains. It can also help people articulate genuine concerns and exercise important rights.

Organisations should therefore avoid making assumptions about a requester simply because AI appears to have been used. The appropriate response is to identify the underlying request, clarify its scope where necessary, and apply the established subject access rules consistently.

The technology may be new, but the core principles remain familiar: recognise the request, communicate clearly, conduct reasonable and proportionate searches, protect the rights of others, and respond within the statutory timeframe.

How can CG help?

CG’s data protection team regularly supports organisations with subject access requests and the wider governance issues arising from the use of AI.

We can assist with:

• reviewing and updating SAR policies, procedures and response templates;

• advising on complex, high-volume or wide-ranging requests;

• supporting the application of exemptions and the manifestly unfounded or excessive test;

• delivering practical training for HR, information governance and customer-facing teams;

• developing policies governing employees’ use of generative AI;

• reviewing AI suppliers, contracts and data-processing arrangements;

• carrying out data protection impact assessments for AI tools; and

• assessing whether AI-enabled processes comply with UK GDPR requirements.

If you would like to review your organisation’s approach to subject access requests or discuss the data protection implications of using AI tools, please contact dataprotection@cgprofessional.co.uk or your usual CG contact.