Aipedia: Data protection consultants

Handling AI-generated subject access requests

Aipedia, by the Apex broking team · Last reviewed 2026-10-27

AI-drafted subject access requests and complaints can arrive in volume, and clients may ask their consultants how to respond without breaching their duties. The ICO plans guidance in Winter 2026, so advice given now rests on existing law and needs care.

Part of: AI in Data protection consultants

In short

Generative AI makes it easy for anyone to produce a detailed, legally phrased subject access request or complaint in seconds, and the number of such requests may be increasing. Clients may ask their data protection consultant whether they can refuse, narrow or delay these requests. The ICO lists guidance on handling subject access requests generated by AI for Winter 2026. Meanwhile, the DUAA has confirmed that searches need only be reasonable and proportionate, and since 19 June 2026 complaints must be acknowledged within 30 days. Advice that leads a client to ignore valid requests can end in enforcement and a claim against the adviser.

What clients are facing

Templates and generative AI chatbots let individuals produce long, formal requests that cite articles of the UK GDPR, demand categories of information and set deadlines. Some arrive in volume, for example from groups of customers or employees. Others arrive alongside complaints drafted in the same style. For a small or mid-sized controller, a sudden increase can swamp the team that normally handles a handful a year.

Complaints add a second layer. A requester who receives a slow or partial answer can use AI to draft a complaint in the same style, and the client must acknowledge it within 30 days. Advice on request handling should therefore cover the complaints process too, so that the two run together rather than as separate queues handled by different people. The underlying data subject rights have not changed because the drafting tool has.

The temptation is to treat these requests as less serious because a machine drafted them. That is where advice matters.

The rules and the guidance gap

The ICO's general data protection guidance plan lists guidance on handling subject access requests generated by AI for Winter 2026. Until it is published, there is no specific ICO position.
The ICO's DUAA summary confirms searches need only be reasonable and proportionate, and that complaints must be acknowledged within 30 days.
Section 103 of the DUAA, on complaints, came into force on 19 June 2026, and section 76 on time limits for subject requests on 5 February 2026, under SI 2026/82.
Section 101 on penalty notices is also in force, and the ICO commencement statement notes the higher PECR maximum of £17.5m or 4% of global turnover.

Until the ICO publishes its guidance, the cautious advice is to treat an AI-drafted request like any other request and apply the existing rules on validity, identity, scope and exemptions.

What can go wrong

Illustrative scenario: a consultant advises a client that a batch of near-identical AI-drafted requests from customers can be treated as a campaign and answered with a standard letter declining to search. Several customers complain, the client misses the 30-day acknowledgement for some complaints, and the ICO makes enquiries. The client has to process every request properly, late, and asks the consultant to pay the extra costs.

The opposite error also happens: advising a client to respond in full to every request without considering whether a narrower, proportionate search is justified, leading to avoidable cost and over-disclosure.

How PI usually responds

A claim that a consultant's advice on handling requests was negligent is usually within PI cover, subject to the wording. The defence will turn on whether the advice was reasonable given the law at the time, which is why advice given before the ICO's guidance should say so. Fines or penalties imposed on the client raise separate questions; see are AI regulatory fines insurable? and does PI cover AI compliance advice errors?

Practical controls

Advise clients to log AI-drafted requests like any other and track deadlines.
Set up a complaints acknowledgement process that meets the 30-day duty.
Document why any narrowing of scope is reasonable and proportionate.
Avoid blanket advice that a class of requests can be ignored.
Flag that the advice predates the ICO's Winter 2026 guidance and diary a review.
Consider whether the client's own AI tools can help triage volume; see AI-assisted DSAR handling.

How Apex helps

Apex arranges PI for data protection consultants. A broker can review how your policy treats advice on rights requests and complaints; see the data protection consultants' AI hub and PI for data protection consultants.

Sources

Frequently asked

Can a client refuse a subject access request because AI wrote it?

There is no ICO guidance saying so, and the ICO's guidance on AI-generated requests is not due until Winter 2026. Until then, the safer advice is to assess the request under the existing rules, as for any other request.

What is the 30-day complaint duty?

Since 19 June 2026, when section 103 of the DUAA came into force, controllers must acknowledge data protection complaints within 30 days. Clients facing high volumes of AI-drafted complaints need a process to meet that deadline.

Should clients wait for the ICO guidance before changing their process?

No. The guidance is due in Winter 2026, but requests and complaints are arriving now and the existing law applies. Clients should build a process that meets current duties, then review it against the ICO guidance once it is published.

Does reasonable and proportionate search help with high volumes?

It can limit the effort required for each request, but it does not remove the duty to respond. The client should record why the searches it ran were reasonable and proportionate in each case.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.