DSARs versus AI: Why Data Subject Access Requests are becoming a growing challenge for housebuilders

Most housebuilders will be familiar with the DSAR – Data Subject Access Request. These legally binding requests for an individual’s personal data have existed since the 1980s but became much better known following the implementation of the GDPR in 2018.

DSARs are often time-consuming and, for housebuilders, are often connected to a customer complaint or wider disagreement about the purchase or occupation of a home. They can require significant effort to gather, review and show the relevant personal data. However, until recently, receiving a DSAR was a relatively rare event for many businesses. 

Over the past couple of years, we’ve seen a significant shift. Housebuilders that previously received few, if any, DSARs are now seeing more requests from customers, often alongside complaints or threatened legal action.

Much of this change is driven by the widespread adoption of customer AI, which is increasing awareness of DSARs. Not only does this lead to more DSARs being made, but AI-drafted DSARs also tend to be lengthier and more complex. And if you push back on the proposed scope, the requestor will use the AI tool to counter your objections and insist on the original scope.

Of course, AI is not only being used by customers. Business use of AI is also increasing the amount of personal data generated and retained, for example through AI-generated call transcripts, meeting summaries and similar records. Taken together with the general increase in technology usage over recent years, businesses are finding that there is far more personal data to search through when a DSAR is received.

As a result, many housebuilders are facing a significant DSAR challenge, with more requests coming in, those requests being more complex, and more data to search through. This trend is likely to accelerate as AI usage becomes increasingly prevalent, both by customers and within businesses, and as customers become more aware of the tools available to help them pursue complaints and disputes.

Why AI is increasing the number and complexity of DSARs

Until recently, DSARs were an obscure legal mechanism which few people were aware of. But now even a simple Google search relating to a dispute that a customer has with your business can result in an AI-generated response at the top of the search results recommending that they make a DSAR and directing them to the ICO standard form.

And if the individual wants help deciding what to ask for, an AI tool can generate an extensive request listing every conceivable location in which an organisation might hold personal data and every imaginable term that might have been used in connection with the individual.

No longer will a request ask for “all personal data relating to me on your systems”. Instead, the individual wants you to search everything from your emails to Slack messages (even though you’ve never used Slack!). You’ll be asked not just for documents but access logs, metadata and phone location data.

Requests to search for the individual’s names, initials and nicknames (did the customer service team really refer to the customer as “Jimbo”?!) are now supplemented by requests for a wide range of other terms with a vague connection to the individual and their dispute. It is now common to see DSARs asking you to search for every document within your entire organisation which includes words such as “defect”, “delay”, “snagging”, “complaint”, “plot”, “completion”, “warranty” or “aftercare”.

And if you seek to challenge the scope of the request, you can expect to receive a comprehensive response that confidently explains why your position is contrary to the UK GDPR, section 45 of the Data Protection Act 2018 (a particular favourite which has no relevance at all unless you are involved in law enforcement) and ICO guidance.

Whilst AI tools clearly have extensive knowledge of the statutory provisions and associated guidance, AI-generated requests frequently give little attention to the requirement under Article 15(1A) UK GDPR that searches should be “reasonable and proportionate”.

AI-generated correspondence can also create unrealistic expectations regarding the nature and extent of information that a requestor is likely to receive. It often contains overly simplistic statements of the law, which are then treated by the requestor as incontrovertible legal fact.

Why AI is increasing the volume of documentation to review

AI is affecting DSARs from both directions. It is making it easier for individuals to submit requests, while simultaneously increasing the volume of information that organisations create and retain. The result is that businesses are receiving more requests and having to review more material when those requests arrive.

For all its benefits, AI is another tool that generates data, and potentially very quickly and in ways that may not have been fully considered or understood. Employees are increasingly interacting with AI assistants throughout the working day, generating prompts, responses, summaries and other records that may contain personal data. In a housebuilding context, this may include customer service teams, sales teams and site staff using AI-assisted tools to summarise complaints, calls, emails, meetings or defect updates.

Depending on the AI tool used and the specific context, personal data input into or generated by AI tools can create particular issues in DSAR reviews. For example, people may be less guarded on calls than they are in emails, particularly where conversations involve difficult customer complaints, delays and defects. Legal advice obtained from AI tools does not benefit from legal privilege in the same way as advice obtained from solicitors, meaning that there may be no valid exemption you can rely on to withhold that advice from the requestor.

The network of interconnected systems that most businesses operate today also creates large quantities of duplicated and linked information. Even where you hold limited substantive information relating to the requestor, searches may still generate a substantial number of results because the same information appears across multiple sources.

The cost of complexity

Undertaking the searches is only the first step. Even if the scope has been carefully considered and the searches properly performed, many of the results are likely to contain no material personal data about the requestor, or to be exempt from disclosure because, for example, they contain personal data relating to other individuals or legally privileged information. Where personal data is identified, it may be mixed with sensitive commercial information which is not disclosable and may need to be withheld to protect your business.

This review is not straightforward and usually requires legal knowledge, judgment and discretion. For example, the application of the legal privilege exemption can be legally complex, while balancing the interests of the requestor against those of other individuals when applying the third-party personal data exemption can be tricky. Decisions also need to be made about the format of disclosure: do you disclose the original document, or extract the personal data from the document and disclose it separately?

As document volumes grow, the review burden grows with them. For many organisations, this has transformed DSARs from a routine compliance exercise into a resource-intensive project involving legal, HR, compliance, IT and management teams.

The practical consequence is that the cost of responding to DSARs is increasing. Internal legal, HR, compliance and IT teams are spending more time on requests, while organisations that previously managed DSARs internally are increasingly finding that specialist support is required for larger or more contentious exercises. The economics of DSAR compliance are changing.

Looking ahead

Despite the significant increase in the burden of dealing with DSARs, the government’s recent reforms have not materially changed the position for organisations responding to complex requests. The Data (Use and Access) Act 2025 has put the “reasonable and proportionate search” concept on a clearer statutory footing, but that does not remove the practical burden of identifying, reviewing and disclosing personal data in a growing data environment.

The challenge of DSARs is therefore likely to grow as AI usage continues to expand, both by customers and within housebuilding businesses.
Housebuilders that review their procedures, improve their data governance and adopt a pragmatic, well-planned approach to DSAR management will be far better placed to deal with this new landscape and mitigate the impact of increasing request and data volumes.