Summary

Public bodies should make rights easy. Instead, we get delay, policy waffle, and paper where a PDF would do; it blocks access, wastes time, and teaches people to give up. I do not give up.

The pattern

1. Paper only for a digital SAR. My email preference was confirmed, yet I received a bulky paper pack. That is the opposite of accessible and the opposite of what the law expects when a request is made electronically.
2. FOI timed out then cost limit. A response after the 20 working day deadline, followed by a cost refusal with no meaningful advice or assistance. I had already anticipated the cost issue and was ready to refine if asked.
3. “Digital pilot” excuse. I was told electronic SARs are limited to a small group of regulated legal representatives on a pilot. That is not a lawful basis to refuse an electronic copy to the person the data is about.

The law at a glance

• UK GDPR Article 15(3): if you make a request electronically, the copy should be provided in a commonly used electronic form unless you ask otherwise.
• UK GDPR Article 12: the controller must facilitate your rights and respond without undue delay, and in any event within one month, with reasons for any extension.
• Data Protection Act 2018 Part 3: for law enforcement data, Section 45 sets the right of access and Section 54 sets the one month time limit. The practical expectation on format and timing remains the same.
• Equality Act 2010 Sections 20 and 29: duty to make reasonable adjustments and not place disabled people at a substantial disadvantage. I am autistic. Digital files are my accessible format. They know this.

Impact in real life

• Access: paper is harder to search, store, and review. Digital is accessible, searchable, and secure.
• Time: printing and postage add delay. Late post does not pause statutory deadlines.
• Trust: when a public body contradicts its own written commitments, confidence drops.

What I required

Reissue the SAR digitally within a short, stated deadline. A single searchable PDF is fine, or a clearly named zipped folder of PDFs. If redactions are applied, provide an exemption schedule that identifies the provision relied upon and explains necessity and proportionality.

Secure delivery options

• Encrypted ZIP or PDF with AES-256, password sent separately by phone or SMS
• Time limited secure download link with access controls and an audit log
• CJSM or an equivalent secure email route

I am technically capable. I handle encryption, secure links, access controls, audit logs, and checksum verification. Any explanation should be technically accurate. If it is not, I will raise it with the ICO and, if needed, the court.

Why the “pilot” excuse fails

• Rights, not convenience: format is part of the right of access when the request is electronic.
• Security can be implemented: use encryption, time limited links, or secure email. A general pilot does not override statutory duties.
• Feasibility already proven: if you can collate, print, and post, you can export to PDF or scan to searchable PDF.

Next steps

• If they comply, good. That is how it should have been done from the start.
• If they stall, good. Let the evidence build, it only proves my point of systemic failings even more.

The takeaway

The games are small, the signal is loud. Access delayed is access denied. I keep receipts, I quote the law, and I finish what I start.

Copy and paste: legal references

You can paste the following into letters, complaints, or escalation emails.

Key points to state

• UK GDPR Article 15(3): where a request is made electronically, the copy must be provided in a commonly used electronic form unless the individual asks otherwise.
• UK GDPR Article 12(2) to 12(4): the controller must facilitate rights, respond without undue delay and within one month, explain any extension within one month, and signpost the ICO if refusing to act.
• Data Protection Act 2018 Part 3, Section 45 and Section 54: for law enforcement processing, there is a right of access and the same one month time limit applies.
• Equality Act 2010, Section 20 and Section 29: duty to make reasonable adjustments and not place disabled people at a substantial disadvantage when providing services or exercising public functions.
• FOIA 2000, Section 16: duty to provide advice and assistance where a cost refusal or scope issue arises.

Short sentences you can drop into a letter

• My request was electronic, so you must supply the copy in a commonly used electronic form. See UK GDPR Article 15(3).
• You must facilitate my rights and respond without undue delay and within one month, with reasons for any extension. See UK GDPR Article 12.
• If you are processing under the law enforcement regime, DPA 2018 Part 3 still provides a one month time limit. See Sections 45 and 54.
• I am disabled and digital files are my accessible format. Refusing digital provision fails the duty to make reasonable adjustments. See Equality Act 2010 Sections 20 and 29.
• If you rely on cost or scope to refuse an FOI, you must offer meaningful advice and assistance. See FOIA Section 16.

References

[1] UK GDPR Article 15(3): https://www.legislation.gov.uk/eur/2016/679/article/15
[2] UK GDPR Article 12:   https://www.legislation.gov.uk/eur/2016/679/article/12
[3] DPA 2018 s45:        https://www.legislation.gov.uk/ukpga/2018/12/section/45
[4] DPA 2018 s54:        https://www.legislation.gov.uk/ukpga/2018/12/section/54
[5] EqA 2010 s20:        https://www.legislation.gov.uk/ukpga/2010/15/section/20
[6] EqA 2010 s29:        https://www.legislation.gov.uk/ukpga/2010/15/section/29
[7] FOIA 2000 s16:       https://www.legislation.gov.uk/ukpga/2000/36/section/16
[8] ICO SAR guidance:    https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-uk-gdpr/individual-rights/right-of-access/
  

Note: This post reflects my experience and the legal duties that apply. It is not legal advice.