Does a SAR Cover Internal Correspondence About Me? UK GDPR Explained

The Reasonable Adjustment • By Kieron JH

Does a SAR Cover Internal Correspondence About Me?

This is one of the most common questions people ask when submitting a Subject Access Request under UK GDPR. It is also one of the areas organisations most frequently misrepresent.

Important: I am not a solicitor, and this article is not legal advice. It is general information based on UK GDPR and ICO guidance. If you need advice on your specific situation, speak to a qualified professional.

The short answer

A Subject Access Request gives you the right to access your personal data. That personal data can include information found in internal emails, notes, messages, or documents, to the extent they relate to you.

There is no blanket exemption for “internal correspondence” under GDPR.

The legal basis

Article 15 UK GDPR provides a right of access to personal data. Personal data is defined very broadly as information relating to an identified or identifiable individual.

This includes more than data you supplied yourself. It can include opinions, assessments, decisions, and internal records about you.

What internal correspondence can be in scope

Internal material may fall within scope of a SAR where it includes:

discussions about you, your behaviour, or your case
opinions or assessments about you
decisions taken about you or affecting you
internal explanations for actions taken against you
case notes, CRM entries, or internal logs referring to you
safeguarding discussions or escalation emails where you are identifiable

The fact that a document is “internal” does not remove it from scope. The only question that matters is whether it contains personal data relating to you.

What a SAR does not give you

This is where organisations often mix truth with misdirection.

A SAR does not entitle you to:

every internal document that merely mentions your name in passing
purely internal policy discussions that do not relate to you
unredacted third party personal data
legally privileged advice
material withheld under a valid GDPR exemption

You are entitled to your personal data, not automatically to entire documents. Redactions are permitted. Blanket refusal is not.

The most common refusal tactic

Many organisations respond to SARs with statements like:

“We do not disclose internal correspondence.”

This is incorrect. GDPR does not recognise “internal correspondence” as a category of exemption. Organisations must search internal systems and disclose personal data found within them, subject to lawful redactions.

How to word a SAR that closes the loopholes

If you want to avoid evasive responses, be explicit. This wording is deliberately precise and ICO-aligned.

In addition to any data I have provided directly, please provide all personal data you hold about me, including personal data contained within internal correspondence.

This includes, where applicable:
- internal emails and attachments
- internal messaging platforms
- case notes, CRM records, and internal logs
- meeting notes or internal briefings referring to me
- opinions, assessments, or characterisations about me
- records of decisions made about me or affecting me

If any data is withheld or redacted, please identify the exemption relied upon.

Why this matters in practice

Internal correspondence is often where the real decision making happens. If support is withdrawn, access is blocked, or allegations are made, the rationale usually appears internally long before it appears externally.

GDPR exists to make that process transparent. Not comfortable. Transparent.

ICO guidance and external sources

If an organisation tells you “internal correspondence is exempt”, ask them to point to the exemption. The silence after that question is usually instructive.