Nigel Wright Group, a blocked SAR, and a controller that went quiet

By Kieron JH, Founder, The Reasonable Adjustment

I submitted a Subject Access Request to Nigel Wright Group on 11 September 2025. The one month legal deadline passed on 11 October. No acknowledgement, no extension, no disclosure. I followed up later than I usually would because of personal circumstances. When I sat down to check my inbox, I expected a response waiting for me. It was not there.

This piece follows on from these two posts, which set the scene and the service questions around trustee Mark Simpson:

What those posts established

I requested a valid route to serve legal correspondence regarding trustee Mark Simpson.
I submitted a SAR to [email protected] with clear scope, format, and a preservation request.
Delivery issues started to appear. My primary addresses were blocked at their perimeter, so I used an alternate address and recorded the bounces.

What changed since then

The one month deadline expired without a response from Nigel Wright Group.
A fresh follow up went to the GDPR inbox. In the same sequence, delivery to [email protected] was blocked with a Mimecast user rule. That does not affect the duty on the controller to respond to a SAR.
The GDPR inbox remains the correct route. A formal notice of non compliance has been sent, and a duplicate pack has been prepared for tracked postal service.

The role of Mark Ingleson, by name

Mark Ingleson, Group Finance Director, placed himself in the middle of this from the start. He emailed to say the issue was private to The Recruitment Junction and not the company, then added that he had reviewed my emails, the live chat that morning, and my website. He invited any legal contact to use the Grey Street address he provided, yet did not ensure a basic GDPR acknowledgement or any SAR handling through the data protection route.

At each step, his responses and the company’s mail blocks narrowed the communication channel, redirected focus away from the DPO, or produced no movement on the statutory obligations. Taken together, this has impeded a straightforward SAR. It should not require an article, a duplicate service pack, and a countdown clock to obtain your own data.

Why the SAR is framed as it is

The request is limited to my personal data and the minimum associated metadata needed to evidence handling. That includes audit trails and reasonable search terms that identify me. It is proportionate and necessary to understand the full picture, and to preserve my right to a fair hearing if litigation becomes necessary. Any attempt to label it manifestly unfounded or excessive misunderstands both the scope and the purpose.

SAR timeline at a glance

11 Sep 2025: SAR submitted to [email protected], preservation requested.
Mid Sep 2025: Follow ups sent from an alternate address after blocks on my primaries.
11 Oct 2025: One month deadline passed with no lawful extension notice.
10 Nov 2025: Further follow up sent. Mimecast blocks delivery to Mark Simpson’s mailbox. The GDPR mailbox remains a valid route.

What I expect Nigel Wright Group to do now

Acknowledge the original SAR and confirm the date it was logged in their internal register.
Disclose all data in scope, including internal correspondence and audit logs in which I am identified or identifiable.
Confirm that a preservation or litigation hold is in place over email, chat, CRM, ticketing, and audit trails.
Explain the missed deadline and identify the person with overall responsibility for data protection compliance.

If this happens to you, do this

Send your SAR to the correct inbox, keep a copy, and ask for preservation of systems.
Calendar one month from receipt. If they need more time, they must tell you early and give a reason.
Avoid collateral bounces. Follow up to the GDPR inbox only, then serve a tracked hard copy to the registered office.
Keep your evidence chain tight. Save delivery receipts and any bounce messages.
Ask for audit trails where they identify you. Handling records can be personal data.
If they do not respond, go to the ICO with a short chronology and your proofs.

Closing note

Most firms handle SARs without drama. Here, silence and mail blocks turned a simple request into a file for a regulator. If an organisation wants trust, it starts by answering its inbox.