DSAR workload is rising, and the people who handle requests are feeling it. In November 2026 the Data Protection Network (DPN), in partnership with ProvePrivacy, published research based on 412 responses from people who handle or oversee data subject access requests. Most reported more requests, more complexity and more pressure than a year earlier.

The survey did not measure wellbeing directly. Yet respondents described stress, burnout and low morale in their own words, alongside a real commitment to the right of access. This article sets out what the research found, what wider UK evidence says about workload and stress, and practical steps that can help teams, managers and individuals. It is written with respect for the people who make requests as well as for those who handle them.

What does the research say about DSAR workload and the people behind it?

DSAR workload is rising, requests are becoming more complex, and many teams are stretched. In the DPN research, 83% of respondents reported more requests than a year earlier. Respondents also described stress, burnout and low morale. These are practitioners’ descriptions rather than measured outcomes.

The survey ran from 9 September to 5 October 2026. Most respondents were data protection professionals: 39% were DPOs or privacy officers and 34% were data protection managers or leads. About four in five (81%) worked in organisations with 250 or more employees. The sample was self selected, so the findings show practitioners’ experience rather than a precise measure of every organisation.

What is happening to request volumes?

83% of respondents said volumes had risen compared with the previous year, and 55% called the rise significant.

The public sector was hit hardest. 91% of public sector respondents reported an increase. Across all sectors, 41% of respondents had received more than 100 requests in the previous 12 months.

Why are requests harder to handle?

62% of respondents said the complexity of requests had increased significantly. The factors they most often chose were the large volume of data to search and assess (77%), requests drafted using AI (76%), unstructured data such as emails (63%) and parallel employment matters (63%).

Only 30% named applying exemptions. The report suggests the challenge lies more in the scale of data and the context of requests than in legal complexity.

Finding	Result
Respondents	412, surveyed 9 September to 5 October 2026
Reported more requests than a year earlier	83% (55% significant)
Public sector respondents reporting an increase	91%
Said complexity had increased significantly	62%
Receive requests likely to be AI generated	92% (55% a significant proportion)
Extend deadlines often or sometimes	64%
Rely on one person, or staff whose main role is not data protection	24%
Want the law changed to reduce the burden	76%

What does it mean for capacity?

Respondents described complex cases taking days or weeks. They also described losing time for data protection impact assessments, advice, training and breach management. 24% rely on one person, or on staff whose main role is not data protection. In short, where one person handles requests, a single complex request can pause almost everything else.

Among respondents whose organisation has a DPO, half said the DPO is directly involved in handling requests. One DPO estimated that DSARs take as much as 90% of their time.

What does it mean for people?

The report says people handling requests reported stress, burnout and low morale. Respondents pointed to the workload, the pressure of deadlines and repeated challenges from requesters. Their comments described the work as relentless, exhausting and, in some cases, crushing.

Deadlines add to the strain. 64% extend the response time often or sometimes because of complexity. The report finds that 40% do not complete at least 90% of requests within one month before any extension. Respondents described long hours and weekend working to keep to deadlines.

Is this only a data protection problem? What does wider UK evidence show?

No. Workload is one of the most common causes of work related stress across the UK. The Health and Safety Executive (HSE) estimates that 964,000 workers had work related stress, depression or anxiety in 2024/25. None of the wider evidence is specific to DSAR teams, but it helps explain what respondents describe and points to lessons DSAR teams can use.

The HSE also estimates that 22.1 million working days were lost to work related stress, depression or anxiety in 2024/25. Rates were higher than average in public administration, human health and social work, and education. The DPN report found the public sector was most affected by rising request volumes. The two datasets measure different things, so they should not be read as a direct link.

Employers in Great Britain have a legal duty to protect workers from stress at work by assessing the risk and acting on it. The HSE Management Standards cover six areas: demands, control, support, relationships, role and change. Workload sits under demands.

The Chartered Institute of Personnel and Development (CIPD) 2025 survey found average absence reached 9.4 days per employee, the highest in more than 15 years. Heavy workloads were the top cause of stress related absence. 64% of organisations take steps to reduce stress, but only 50% think those steps are effective.

In a global survey of more than 1,800 privacy professionals, ISACA found that 65% say their role is more stressful than five years ago. Resource shortages and compliance challenges were among the main contributors. This is a global, membership based survey, not a UK or DSAR specific one.

What can DSAR teams learn from the wider evidence?

DSAR pressure is not unique, and that is good news. Workload, manager support and early conversations matter across UK workplaces, and tested approaches already exist. DSAR teams can borrow them rather than start from scratch, while allowing for pressures particular to this work.

• Workload is the lever that matters most. The CIPD found heavy workloads are the top cause of stress related absence, and Acas polling has found workload is the most common cause of work stress. For DSAR teams, volume, scope and deadlines are the first things to manage.
• Employers already have a framework. The HSE Management Standards give managers a way to assess demands, control and support. DSAR workload can be discussed in familiar terms, not as a special case.
• Action needs to change the work. Only half of the organisations taking steps to reduce stress think those steps are effective. The gap is a reminder to look at what actually changes the work, as well as at support offered alongside it.
• Small teams are exposed everywhere. ISACA found resource shortages contribute to stress among privacy professionals, and 24% of DPN respondents rely on one person or on staff with other main duties.

The point is not that DSARs are the same as every other workplace pressure. Statutory deadlines, requester challenges and the new complaints process are particular to this work. The point is that teams do not have to wait for DSAR specific research to act. The wider evidence already shows where to start, and the rest of this article builds on it.

What happens after the response is sent?

For many teams the work does not end when a response goes out. 22% of respondents say requesters often reply that they are dissatisfied, and 45% say it happens sometimes. 29% had received ICO correspondence about DSAR complaints in the past 12 months. Since 19 June 2026, organisations must also have a data protection complaints process.

Respondents described follow ups drafted using AI, sometimes arriving within minutes of a disclosure. Among those describing the impact of AI generated requests, 23% mentioned follow ups, challenges and complaints, and 18% said clarifying a request had become harder, with some caught in a loop of repeated exchanges.

The new complaints process adds a formal step. Organisations must let people complain directly, acknowledge complaints within 30 days and respond without undue delay. Some respondents said requests are now handled two or three times as they pass through internal complaints and on to the ICO. One expected the new requirement to likely double the load.

The regulator is busy too. The ICO received 76,743 data protection complaints in 2025/26, up 81% from 42,315 the year before. These figures cover all data protection complaints, not only DSARs. The ICO responded to 27.4% of complaints within 90 days. Several respondents noted that when complaints reach the ICO, the original response is frequently upheld.

How might complaints affect the people being complained about?

There is no research on how DSAR follow ups feel to the people handling them. There is, however, relevant UK research on how people feel when they are complained about. A 2017 University of Glasgow study surveyed staff in Scottish local authority planning departments and housing associations who had been the subject of a complaint. It gathered 132 survey responses and followed up with 16 interviews.

Among those who had been complained about, 71% said it affected their work practice and about 67% said it affected their health and wellbeing. Most said they were affected to some extent, and a significant minority said a great deal. Harm was greater when a complaint felt like a personal attack, when the consequences were unclear, and when people were not told the outcome.

This study has clear limits. It covers staff who were complained about, not people who handle requests, in two settings in Scotland. The sample is small, the data are self reported and the research dates from 2017. It cannot show how DSAR teams feel.

What it offers is a set of useful questions. Does the pace of challenges matter? Does uncertainty about whether a decision will stand add to the strain? Do clear processes and support make a difference? The DPN report did not ask, so practitioners’ own answers matter.

How can teams reduce DSAR workload and pressure?

The strongest evidence points to workload and process first, then support from managers and colleagues, then individual coping. Individual wellbeing tips help, but research suggests that programmes aimed only at individuals do little unless the way work is organised also changes.

How can process reduce the pressure?

Use the tools the law and the ICO already give you. Clarify unclear requests early and stop the clock. Make reasonable and proportionate searches. Use an extension where it is genuinely justified. Record your decisions so you can explain them calmly later.

Stop the clock is a provision that pauses the response deadline while you wait for information needed to clarify a request. A reasonable and proportionate search is the standard the ICO says applies when you look for personal data to answer a request. You are not expected to search everywhere.

Some practical steps follow from the guidance:

• Triage every request on the day it arrives, and decide who owns it.
• Hold a scoping conversation early, and record what the requester says they need.
• Agree an internal deadline well before the statutory one.
• Keep a clear record of what was searched, what was withheld and why.
• Use the extension of up to a further two months where a request is complex or you have received several from the same person, and note your reasons.
• Protect time for complex cases and agree who covers when someone is away.

You can refuse a request only if it is manifestly unfounded or manifestly excessive. The ICO says to consider each request individually, avoid blanket policies, and keep strong reasons you can justify to the requester and the regulator. Aggressive language does not by itself make a request manifestly unfounded. The guidance is under review following the Data (Use and Access) Act 2025, so check for updates.

Respondents asked for clearer guidance on reasonable searches and on what makes a request complex. Until that arrives, written reasoning is your best protection.

Other UK complaint bodies have policies for repeated or abusive contact, such as a named contact, a recorded contact strategy and the right for staff to end abusive calls. Data protection teams may find these models useful. Take advice before adapting them, because the right of access still applies.

How can teams and managers support each other?

Managers and colleagues make the biggest difference after process. The HSE and Acas recommend regular conversations, early action and a written risk assessment. Handover plans, shared cases and honest talk about capacity help most in sole practitioner and small teams.

The HSE Working Minds campaign sets out five steps for employers:

• Reach out and have conversations.
• Recognise the signs and causes of stress.
• Respond to the risks you identify.
• Reflect on what you have done.
• Make it routine.

The HSE also provides Talking Toolkits, free online learning, a risk assessment template and a Stress Indicator Tool that is free to pilot for up to 50 employees. Mind offers Wellness Action Plans for workplace, hybrid and remote working, with a version for line managers.

Talking does not always come easily. A 2019 Acas poll found only 43% of employees would talk to their manager if stressed or anxious, 42% would talk to a colleague, and 22% would talk to no one at work. Making it normal to say that a case is heavy is a simple place to start.

Practical ideas for teams include debriefing after difficult requests, sharing complex cases, pairing up for redaction and review, and agreeing how to ask for help. Some respondents use outside support when demand exceeds capacity: 12% use an external service for part of a request.

What can individuals do to cope?

Talk to someone early, whether a manager, a colleague, a trade union or staff representative, HR or an employee assistance programme. Use tools such as a Wellness Action Plan, take real breaks and keep a clear end to the working day. If you are in distress, contact your GP or Samaritans on 116 123.

It is common to feel frustrated, anxious or personally criticised when a requester challenges your work. Research on staff who were complained about found shock, anger and loss of confidence were common reactions. Those feelings are not a sign you are bad at your job.

Some practical steps from UK sources:

• Tell your manager early if workload is the problem. The HSE says this gives them the chance to help and stop things getting worse.
• Complete a Wellness Action Plan from Mind to map your triggers, what helps and what support you need.
• Try the free NHS Every Mind Matters Mind Plan quiz for tailored tips.
• Take short breaks, and finish the day by writing a list for tomorrow so you can switch off.
• Talk to colleagues or friends about how you feel.

Carolyn Hirst, a researcher who works on complaint handler wellbeing, suggests useful self check questions. Do you have the support you need, at the time you need it? Are you recognised and thanked for what you do? Do you have time to reflect? They were written for complaint handlers but apply well here.

Resilience alone is not the answer. If the workload is unsustainable, that is a problem to raise, not one to absorb.

Can a better way of working reduce avoidable work?

Yes, in part. Much DSAR effort goes on repetitive tasks: finding the same email in several places, checking personal data line by line, and tracking deadlines in spreadsheets. A structured way of working, supported by suitable tools, can reduce that avoidable effort. It does not replace resourcing, leadership support or good process.

Around one in four respondents (24%) use purpose built tools to manage most of the DSAR lifecycle. 68% use redaction tools, and only 7% use AI powered redaction. Respondents who selected other mostly rely on manual processes or standard PDF software.

Area	Reactive handling	Structured handling
Finding information	Searching each system and mailbox separately	One organised record of what was requested and where it was found
Duplicate emails	The same thread read several times	Repeated messages grouped so each is reviewed once
Spotting personal data	Read line by line	Software helps find personal data and a person decides what is disclosed
Recording decisions	Notes in several places	A clear record of what was withheld, which exemption applied and why
Deadlines	Tracked in spreadsheets or memory	Deadlines and clock stops visible to the whole team
Disclosure	Files sent by email	Files shared through a secure route
Cover for absence	Knowledge sits with one person	Work can be handed over because everything is recorded

We found no independent research showing that tools reduce stress for DSAR teams. What they can do is reduce the repetitive manual parts of the job, which relates to the demands on a person’s time.

When choosing support, look for a clear audit trail, human control over every decision, secure handling of data, coverage of the sources you use, and evidence of time saved from similar teams. Ask what happens when the work is not routine, because many requests are not.

How can leaders make the case for more DSAR support?

Use evidence. Combine the DPN figures on volume and deadlines, the employer duty to assess work related stress, and your own data on time spent and deadlines missed. Then ask for something specific: cover, protected time, outside support for peaks, or better tools.

A short checklist can help:

• Log requests, time per request, extensions, complaints and overtime for at least a quarter.
• Show which colleagues outside the data protection team are pulled in, and the work they are not doing.
• List the costs respondents report: new roles, overtime, temporary support, outsourcing, legal advice, redaction tools and extra IT capacity.
• Explain the risk for sole practitioners: a single complex request can stop other work.
• Ask whether DSAR workload has been considered in the organisation’s own assessment of work related stress. This is a question for each employer and is not legal advice.
• Propose options with costs and agree a date to review.

Leaders also have a part to play in recognition. Asking how the team is coping, acknowledging the effort and keeping up to date with the volumes sends a signal that the work is seen.

What do we still not know about DSAR teams and stress?

A lot. The DPN report did not measure wellbeing, and we found no UK statistics on stress or burnout among DSAR handlers or DPOs. The closest comparisons are broader surveys of privacy professionals and workers generally. We do not yet know whether follow ups and the new complaints process affect how people feel, or which approaches help most.

Steve Wood, a former UK Deputy Information Commissioner, said it is right to start a wider discussion in the data protection community about how to tackle these challenges in the short, medium and long term. Stephen McCartney, an independent consultant and former DPO, said the report should be a wake up call that so many practitioners think the balance of rights has tipped too far, while still valuing the right of access.

If you handle or oversee DSARs, your experience matters. Share what helps your team with DPN or ProvePrivacy so that practical guidance can reflect real practice.

Frequently asked questions

Does the DPN report show that DSAR teams are suffering from burnout?

Not directly. The survey did not measure burnout or stress. Respondents described stress, burnout and low morale in free text answers, and those descriptions were coded into themes. The report is a snapshot of practitioners’ experience from a self selected sample.

Can an organisation refuse a DSAR because it is too much work?

Only if the request is manifestly unfounded or manifestly excessive, judged individually. The ICO says there should be no blanket policy and the reasons must be recorded and justifiable. Check the current ICO guidance, which is under review following the Data (Use and Access) Act 2025.

What is the stop the clock rule?

Stop the clock lets an organisation pause the response deadline while it waits for information it reasonably needs to clarify a request. The clock restarts when the clarification arrives. The ICO says to ask as soon as possible and not to use clarification to extend the deadline unnecessarily.

Where can DSAR handlers find support?

The HSE Working Minds resources, Acas, Mind, NHS Every Mind Matters, an employer’s assistance programme, your GP and Samaritans on 116 123 are all useful starting points. If workload is the problem, raise it with your manager early.

Conclusion

Behind every DSAR is a person who wants to know what an organisation holds about them. Behind every response is a person doing their best under a deadline. The research shows the pressure on those people is real, even where its exact size is not yet measured.

The evidence points to practical steps: fix workload and process first, support each other, and look after yourself without treating resilience as the whole answer. The right of access matters, and so do the people who make it work.

How does ProvePrivacy help reduce DSAR workload?

ProvePrivacy helps data protection teams manage DSARs from intake to response, with deadline tracking, AI based detection of personal data for redaction, and secure disclosure. Your team still decides what is disclosed. Explore the latest DSAR and FOI software update, book a short demonstration or read the full State of DSARs report. The research was carried out by Data Protection Network in partnership with ProvePrivacy.

Sources

• Data Protection Network, The State of DSARs Research Report
• HSE, Work-related stress, depression or anxiety statistics in Great Britain
• HSE, Management Standards for work-related stress
• HSE, Working Minds campaign
• CIPD, Health and wellbeing at work 2025
• ISACA, State of Privacy survey
• Mind, Wellness Action Plans
• ICO, Right of access guidance

This article is general information, not legal or medical advice.