What happens when a subject access request includes information about other individuals?

How organisations handle third-party information in a subject access request

A subject access request does not automatically give the requester a right to see other people’s personal data. The practical task is to separate what belongs to the requester from what belongs to others, then decide whether the third-party material can be removed, masked, or edited while still leaving meaningful disclosure. That judgement is usually case-specific and needs a clear audit trail.

If the other individual’s identity can be protected by redaction or selective deletion, that is usually the preferred route because it preserves the requester’s access rights without over-disclosing personal information. Where the two sets of information are genuinely inseparable, the organisation has to balance disclosure against the other person’s privacy, and that balance should be recorded rather than guessed.

In practice, this is as much a records-handling problem as a legal one: teams need to know which systems hold mixed-person data, how they will identify third-party references quickly, and who has authority to decide that partial disclosure is sufficient. Without that process, organisations tend to over-withhold or over-disclose, both of which create avoidable compliance risk.

When redaction is enough and when it is not

Redaction works best when the requester’s own data can still be understood after names, identifiers, and other directly identifying details are removed. The aim is not perfect anonymity in every case, but disclosure that remains intelligible and proportionate. If removing the third-party material would strip the record of its meaning, then a more limited response may be justified.

The key test is whether the organisation can give access to the requester’s personal data without revealing information that would identify another person. That may involve deleting names, masking contact details, or editing narrative text so the substance remains while the other person cannot reasonably be identified. A Identity Data Privacy and Consent Guide is useful here because the same minimisation logic applies when deciding how much personal data can be safely disclosed.

When redaction is impossible, the organisation should document why the mixed information could not be separated in a reliable way and why withholding was the least harmful option. That record matters because the decision is often reviewed later, either by the requester, a regulator, or internal assurance teams.

Why this becomes a governance and evidence question

Mixed-person records force an organisation to show its reasoning, not just its outcome. It should be able to explain that it considered consent, whether disclosure was reasonable in the circumstances, and whether the requester’s rights could be met through a narrower version of the record. That is especially important where the response is partial, because a bare refusal can look arbitrary even when it is legally defensible.

The most useful operational evidence is the decision trail: what was reviewed, what was redacted, what was withheld, and why each step was taken. A useful internal reference point is IAM and IGA Basics, because access governance disciplines such as review, entitlement control, and documented decision-making translate well to privacy response workflows.

Good handling also depends on consistency. If similar requests are treated differently, the organisation may still be compliant in one case and exposed in another. The goal is a repeatable method for mixed data, not ad hoc judgement from case to case.

Risk and Threat Considerations

Third-party material in a subject access response creates two failure modes: accidental disclosure of another person’s identity, or excessive withholding that prevents the requester from receiving information they are entitled to see. Both outcomes can create legal, privacy, and trust problems, especially when records are shared across teams that do not apply the same redaction standard.

Failure mechanism: The organisation either fails to separate intertwined personal data before disclosure, or it withholds too much because the record owner cannot safely edit the material quickly enough. Weak indexing, poor record ownership, and inconsistent review steps make both errors more likely.

Impact: Over-disclosure can expose a third party’s personal data, while over-withholding can trigger complaints, regulatory scrutiny, and rework. In either case, the organisation’s position is strongest when it can show a proportionate review, a documented balancing decision, and a clear reason why the chosen outcome was the least intrusive one available.

Practitioner Guidance

What to prioritise: Build a repeatable review path for mixed-person records before you need it. The first question should be whether the requester’s data can be disclosed intelligibly after redaction, not whether the file is convenient to release in full.

What to verify: Confirm that the reviewer can point to the specific third-party content, the redaction method used, and the reason consent or reasonableness was considered before any refusal. If those points are not documented, the decision is harder to defend later.

Practitioner takeaway: The safest approach is usually not all-or-nothing disclosure, but a defensible edit-and-explain process that preserves the requester’s rights while showing exactly why any remaining third-party material could not be shared.

Related resources from NHI Mgmt Group

• What happens when organisations delay updating cookies, automated decision making, and subject access request processes under the DUAA?
• What happens when a subject access request is handled without a complete search of all environments?
• How should security teams run access reviews for non-human identities?
• How should security teams govern non-human identities that have persistent access?