This guide covers the SAR exemption for protecting third party identities under the Data Protection Act 2018.
A case note, an email chain or a complaint file almost always says something about someone other than the requester too. Do you redact the obvious name and move on, or is there more to it than that? This is exactly where the SAR exemption for protecting third party identities comes in, and it’s the one exemption in this series that applies by default to almost every subject access request you’ll ever handle.
The general rule is straightforward to state but easy to get wrong in practice: a controller isn’t obliged to disclose information to the extent doing so would identify another individual, unless that person consents or it’s reasonable to disclose without their consent. Working out what’s reasonable means weighing whether a duty of confidence is owed, what the requester already knows, and the likely impact of disclosure, not defaulting to a blanket answer in either direction.
Why removing a name isn’t the same as removing identifiability
The SAR exemption for protecting third party identities exists because personal data rarely sits in isolation. The mistake we see constantly is deleting the obvious name while leaving in enough surrounding detail, a job title, a date, a department, for the requester to work out exactly who it was anyway. Identifiability has to be tested against what the requester already knows or could reasonably obtain, not just what’s visible on the page.
This guide walks through the ICO’s three step process, the presumption of reasonableness that applies to health, social work and education professionals, and the pitfall that catches out more responses than any other in this series.
Once you’ve identified what needs protecting, precise handling of everything else matters just as much. The ProvePrivacy platform’s DSAR Redaction Tool, available to every client, is built for exactly this kind of precise redaction rather than a blanket withhold. Download the full guide below to see how the three step process actually works in practice.