Are there any limits on data that must be provided as part of a GDPR subject access request (SAR) based on the age of the data?

The particular case I am thinking about is SAR made to the 3 credit reference agencies. As I understand it they only keep my credit data for 6 years, but I would expect them to keep sales data for much longer. Say they know that they sold a large dataset to a third party 20 years ago, and cannot definitively say my data was not included. Are they required to give me details of this transaction? What if they had a potential data breach 20 years ago, would they be required to give details of this? Is there any particular language I should use in my SAR to make sure this is included?

1 Answer 1


In principle, the data subject's right to access involves a copy of all personal data the controller holds on them. There are no time limits by default. Of course, the controller can ask a data subject to clarify their request, e.g. to focus on a particular time frame.

There is an implied time limit though: personal data may only be processed/stored for as long as the data is necessary to achieve the purposes for which it was collected. Afterwards, it must be deleted. A controller with good data management will be able to limit their effort by having as short retention periods as possible for their different records.

Furthermore, a lot of data is not personal data, or falls out of scope of the GDPR because it is not processed with automated means or forms part of a filing system. For example, if thousands of old invoices were archived in paper form in boxes that are only sorted by year, there might be an argument that this isn't a filing system in the sense of the GDPR and that a DSAR would not have to involve looking through all the archived invoices (compare also Art 11).

In your scenario, there is a clear retention period of six years. You are asking for records about how that data might have been used further in the past. To the degree that such data is actually available, that could reasonably be personal data and should be included in a response to a DSAR.

  • E.g. they might have information like this: “File #1234 was included in a data set that was sold to EvilCorp in 2007. The entries in File #1234 that are older than 2014 have been purged, so we do not know which entries were included in the data set. The current name on File #1234 is Dave.” This information about the sale would be personal data because it relates to you, and you are identifiable. Of course, the controller might not be set up to perform this search unless specifically asked.

  • However, more unspecific information might not be personal data. For example: “About 70% of our files were included in a data set that was sold to EvilCorp in 2007. We no longer have records indicating whether your file was included.” Since there is no link between the sale and your personal data, I don't think it would have to be included in a DSAR response.

The primary reason why you should be told about sales of personal data is that per Art 15(1)(c), you should be informed about “the recipients or categories of recipient to whom the personal data have been or will be disclosed” in a DSAR response.

So when making a data subject access request, it could make sense to explicitly referencing this paragraph. So you would be interested in receiving a copy of your personal data as per Art 15 GDPR, and in particular any available information per Art 15(1)(c) GDPR about the recipients or categories of recipients to whom your personal data has been or may have been disclosed in the past.

Quite likely the response will be underwhelming, e.g. by just giving a broad category such as “potential creditors who are contractually obligated to use the data only in accordance with our policies”. Whether such responses are compliant (I don't necessarily think so) will not be clear until there's a good precedent, and that would require that someone sorts this out in court.

  • It's worth noting GDPR also has "proportionality" and "undue burden" clauses so it's quite likely that if the company can show that responding to the SAR in a more complete way would cost a lot of money or effort and/or the significance and gain by the person seeking the information is low, they would be exempt from providing that data.
    – DRF
    Commented Nov 26, 2020 at 22:19
  • 1
    @DRF Actually for rights of access the threshold for refusal (or charging a fee) is much higher - " manifestly unfounded or excessive" rather than proportionality or undue burden. (see Article 12(5)). The concept of proportionality does appear in the GDPR but in other contexts (e.g. fines).
    – JBentley
    Commented Jul 20, 2021 at 11:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .