How a UK ruling shapes DSAR compliance

Data subject access requests remains the most exercised data protection right. In 2024, 36% of internet users globally exercised their access rights, up from 24% in 2022. Unsurprisingly, compliance with DSARs continues to appear at the top of regulatory enforcement priorities.

The essence of the right, according to Recital 63 of the U.K. General Data Protection Regulation, is to enable data subjects to be aware of and verify the lawfulness of the processing of their personal data. The importance of the right is buttressed by the fact that without access, data subjects cannot meaningfully exercise other rights such as rights to rectification, restriction, erasure, objection or compensation.

Yet despite its imperativeness, the practical scope of the right of access is often disputed. A recurring question is whether Article 15 of the U.K. GDPR entitles data subjects to documents containing their personal data or merely to copies the personal data extracted from those documents. The January 2025 decision of the High Court of Justice in Ashley v The Commissioners for His Majesty's Revenue and Customs provides important judicial guidance on this issue.

Background

The claimant, Michael Ashley submitted a DSAR to HMRC seeking "all information held in relation to" him in connection with HMRC's enquiry into his tax return for the 2011/2012 tax year. When HMRC failed to treat his request within statutory timelines, he issued proceedings alleging breach of his right under Article 15 of the U.K. GDPR.