How to Handle AI-Generated DSARs

Generative AI now lets people produce long, highly detailed Data Subject Access Requests (DSARs) in minutes, and organisations are seeing more requests with broader search scopes and harder disclosure decisions, all under the usual one-month deadline. This blog from The DPO Centre explains that using AI to draft a DSAR doesn’t change anyone’s right of access, and it doesn’t give organisations automatic grounds to limit or refuse the request. A request being lengthy, burdensome or AI-generated isn’t enough on its own to count as manifestly unfounded or excessive, and the threshold for refusal is high.

The article from the DPO Centre, part of Axiom GRC, sets out what organisations can legally do when a request becomes hard to manage: ask for clarification (which can pause the deadline), carry out a reasonable and proportionate search (as clarified by the Data Use and Access Act 2025), extend the response period by up to two months for complex requests, or, in limited cases, refuse or charge a fee. It also recommends practical preparation: knowing where personal data is held, setting up a clear triage process and escalation points, making searches repeatable and defensible, and documenting key decisions.