What happened
On 11 November 2026 the UK Information Commissioner's Office published new guidance on subject access requests generated or drafted using AI (AI-assisted SARs) under Article 15 UK GDPR. It confirms an AI-assisted SAR is not invalid merely because AI was used to draft it; organisations must treat it like any other SAR. It explains how to handle lengthy/repetitive/unclear or factually inaccurate requests (including AI 'hallucinations' about rights, foreign legal references or false contact details), the available options (clarification, deadline extension, manifestly unfounded/excessive), the requirement to make reasonable and proportionate searches, and how to respond where an individual or third party uses AI to fabricate identity or letters of authority.
Why it matters
This is authoritative interpretive guidance from the UK data-protection regulator on a fast-growing AI-triggered burden. It sets concrete regulatory expectations (the guidance frames what organisations 'must' do) for any UK organisation receiving SARs, and clarifies the data-protection treatment of AI-generated requests, which is relevant to organisations' AI-assisted data-subject workflows and to fraud/identity-verification risk introduced by AI-generated fabricated documentation.
Action needed
UK controllers should update their SAR handling procedures and staff training to recognise and process AI-assisted SARs, adopt clarification/extension workflows, verify identity and authority more carefully where AI-generated documents are suspected, and ensure reasonable-and-proportionate-search policies are applied without treating the request as invalid.