Third-party data in SARs: when to redact, when to disclose

Almost every subject access request contains information about people other than the requester: colleagues, managers, clinicians, family members, other customers. The right of access does not extend to their personal data, but it does not automatically exclude it either. UK GDPR Article 15(4) says the right to obtain a copy must not adversely affect the rights and freedoms of others, and the Data Protection Act 2018, Schedule 2, Part 3, paragraph 16 sets out when information about another individual may be withheld.

The practical test is whether it is reasonable to disclose the information without the other person's consent. This guide sets out how to work through that test consistently, and how to record the outcome so it can be defended.

Start by identifying the person, not the passage

Reviewing page by page invites inconsistency: the same colleague is treated one way on page 40 and another on page 400. Start instead by identifying each third party who appears in the material and their role in relation to the requester. A line manager's comments about the requester's performance are in a different position from a colleague's comments about their own workload, and both are different again from a family member's contact details.

Is it the requester's personal data at all?

Much third-party material is also information about the requester: a manager's opinion of the requester is the requester's personal data, even though it identifies the manager. Information that is only about the other person, such as their own circumstances, is not within scope of the request and can be withheld on that basis before any balancing exercise is needed.

The reasonableness factors

• The type of information. Opinions given in a professional capacity are more likely to be disclosable than private details.
• Any duty of confidentiality owed to the other person.
• Whether consent was sought and whether the other person has refused.
• Whether the other person is a professional acting in that capacity, such as a clinician or a caseworker. Their professional involvement is often already known to the requester.
• Any express refusal of consent, and the reason for it.
• The requester's legitimate interest in the information, including the context in which they asked.

Mixed sentences

The hardest passages are those where the requester's data and a third party's are intertwined in one sentence. Redact the minimum that protects the third party and disclose the rest; do not withhold a paragraph because one clause is difficult. Where a passage cannot be separated, record why.

Record the reason, every time

A third-party redaction without a recorded reason is indefensible, not because the decision was wrong but because it cannot be shown to have been made. Use reason templates that reference the provision relied on and the factors considered, and keep the reviewer and the time. If the decision is later challenged, the reason is your answer.