This DSAR scoping guide shows data protection teams how to narrow a large set of discovered documents into a focused review set, without leaving gaps the ICO or a court could challenge. Read the essentials on this page, then download the full guide for the detail.
What is DSAR scoping, and why does it matter?
DSAR scoping is the process of deciding which people, systems, date ranges and documents must be searched and reviewed to answer a data subject access request. The aim is the narrowest review set that still gives the requester everything the law entitles them to. Scoping sits between discovery and review. Discovery gathers everything that might hold the person’s data, and scoping then reduces that pool before review and redaction begin.
Scoping matters because review is the most expensive stage. The Data (Use and Access) Act 2025 also writes a reasonable and proportionate search standard into Article 15 of the UK GDPR, so every scoping decision needs to be one you can explain. The ICO right of access guidance sets out how it expects that standard to be applied.
How do you scope a DSAR? The six steps in brief
To scope a DSAR, interpret the request, clarify it only where needed, map your systems, reduce volume with documented filters, test for personal data relevance, then record and sign off every decision. Follow the order, because each step depends on the one before.
- Interpret the request. Read it for what the person actually asks for.
- Clarify where genuinely needed. Ask once, early and specifically.
- Map systems and set search parameters. Start with core sources and include nicknames and aliases.
- Reduce volume with documented filters. Record the document count before and after each filter.
- Test for personal data relevance. Sample what you exclude.
- Record and sign off. Keep a scoping record that a named person approves.
The full guide explains how to carry out each step, including the stop the clock rules, the safe data reduction techniques and the pitfalls to avoid before review and redaction begin.
Who should read this DSAR scoping guide?
This DSAR scoping guide is written for data protection officers, information governance leads and privacy teams who handle subject access requests and need to reduce a large discovery set without creating risk. It is equally useful for the legal, HR and IT colleagues who are asked to search mailboxes, chat tools and shared drives on behalf of the DPO.
What are the most common DSAR scoping mistakes?
The most common mistakes are narrowing too early, relying on search terms that nobody has tested, and failing to record why material was excluded. Each one can leave a gap in the response that the requester, the ICO or a court may challenge. The DSAR scoping guide sets out all nine pitfalls with a practical fix for each, so your team can scope with confidence and show its working.
What is inside the free DSAR scoping guide?
The free ProvePrivacy guide is a practical PDF for data protection and information governance teams. It sets out the legal test for searches, a six step scoping method, the safe ways to reduce a review set, the common pitfalls and the scoping record that makes your decisions defensible.
Inside the guide you will find:
- What the law says about how far you must search, including Article 15(1A) and the ICO’s four factors.
- A six step method for scoping a DSAR, from interpreting the request to sign off.
- When you can ask for clarification and stop the clock, and the limits that apply.
- What counts as personal data, and which documents can safely leave the review set.
- A table of data reduction techniques, with the benefit and the risk of each.
- A table of nine common scoping pitfalls, with a practical solution for each.
- The contents of a defensible scoping record and four questions to test every exclusion.
- Answers to five frequently asked questions about DSAR scoping.
- A comparison of a manual DSAR procedure with the ProvePrivacy platform.
How does the ProvePrivacy platform help with DSARs?
The ProvePrivacy platform is a GDPR compliance platform for busy data protection teams. It logs and manages DSARs in structured, auditable workflows, replacing spreadsheets and disconnected processes with one record of each request, so scoping decisions can sit alongside the request they relate to. Teams that mainly need DSAR and FOI handling can also look at ProvePrivacy Lite.
The table below compares a typical manual procedure with the ProvePrivacy platform on the parts of the process that scoping depends on.
| Capability | Manual procedure | ProvePrivacy platform |
|---|---|---|
| Record of each request | Scattered across files and inboxes | One central record per request |
| Deadline tracking | Calendar reminders and manual counting | Logging and management designed to meet ICO reporting timescales |
| Scoping of requests | Resource heavy and high risk, with duplicates and search terms handled by hand | Assisted deduplication and search term support |
| Redacting the records | Time consuming and frustrating | Personal data identified automatically to guide redaction |
| Recording exemptions | Held in notes, so trends are hard to see | Exemptions categorised for management reporting |
| Delivering the disclosure | Sent by email, or data left exposed on shared platforms | Secure, time limited delivery directly from the platform |
| Consistency between requests | Varies by person and by month | Structured process applied to every request |
| Access for non specialist staff | Needs knowledge of how the spreadsheet is built | Designed to be usable without deep data protection expertise |
| Management visibility | Manual reporting | Real time dashboards and interactive reporting |
Download the free DSAR scoping guide
Download the free DSAR scoping guide to get the full six step method, the data reduction techniques table, the pitfalls table and the checklist for a defensible scoping record. Enter your details in the form below to receive your copy.