Bob was party to an incident in a shop that keeps CCTV footage for 30 days. 28 days later he submits a request for this responsive footage, but neglects to include with it adequate selfidentification materials like license or proof of address.

Two slightly different questions here which I think are similar enough to be asked in a single post:

Suppose they have a SAR processing backlog of 3 days by which time the data will have been deleted. Do they have why duty to first preliminarily review any requests and triage them by material auto deletion date?

And secondly, forgetting any processing backlog related lead times, remembering that Bob had failed to include adequate identification proof to satisfy the data controller's procedures, must they make efforts to preserve the responsive materials even if they feel that they cannot yet responsibly disclose them to Bob while his request pends due to inadequate identification?


1 Answer 1


As I understand it there is no obligation to 'triage' SARs or keep data 'just-in-case' that would otherwise be deleted as a matter of routine.

Can we amend or delete data following receipt of a SAR?

It is our view that a SAR relates to the data you held at the time you received the request. However, in many cases, routine use of the data may result in it being amended or even deleted while you are dealing with the request. So it is reasonable for you to supply the information you hold when you respond, even if this is different to what you held when you received the request.

However, it is not acceptable to amend or delete the data if you would not otherwise have done so. Under the DPA 2018, it is an offence to make any amendment with the intention of preventing its disclosure.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .