Every SAR response should be checked against one rule before it goes out, whatever other exemptions apply. A case note, an email chain or a complaint file usually says something about someone other than the requester too, and this exemption is the one that applies by default across almost every request you handle.

This final guide in the series covers the ICO’s three step process for deciding whether a third party can be identified, why removing a name is not the same as removing identifiability, and the presumption of reasonableness that applies to health, social work and education workers. Download it as the one guide every reader in this series needs, regardless of which other exemptions are relevant.