Can we force a person to make a SAR?

Due to the Data (Use and Access) Act coming into law on 19 June 2025, this guidance is under review and may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen.
This guidance has been updated to reflect changes to the right of access brought about by the Data (Use and Access) Act. Some of these changes are not yet in force. However, we think it is useful for it to be published now so that you are ready for these changes. In particular, they set out that you only have to carry out a reasonable and proportionate search in response to a SAR; and that you can ‘stop the clock’ when asking for clarification on a request.

Contents

What is an enforced SAR?

An enforced SAR is when someone:

requires a person to make a SAR to gain access to certain information about them (eg their convictions, cautions or health records); and then
uses this information – for example, as supporting evidence for a job application or before approving a contract for insurance.

Forcing a person to make a SAR in such circumstances is a criminal offence.

Example

A person applies for a position as a waiter at a restaurant, but they are told that they cannot be offered the position until they provide a copy of their criminal record. The employer states that they need to make a SAR to gain this information and they will only be appointed if they supply it. The employer is likely to have committed a criminal offence.

Example

A person makes an application to an insurance provider for private health insurance. The provider agrees to insure the person but explains that, as a condition of the insurance, the person needs to make and provide the results of a SAR for their medical records. The insurance company is likely to have committed an offence.

More appropriate ways are available for accessing relevant information – for example, through the criminal disclosure regime for criminal records or the Access to Medical Reports Act 1988 for health records.

When does it apply?

It is a criminal offence to require a person to provide you with a copy of or access to a relevant record in connection with:

your recruitment of an employee;
a person’s continued employment by you; or
a contract for the provision of services to you.

It is also a criminal offence to require another person to make and provide the results of a SAR for a relevant record if:

you are involved in providing goods, facilities or services to the public or a section of the public; and
it is a condition of providing a person with goods, facilities or services, or allowing them to do voluntary work.

Example

A person applies to do voluntary work with a charity. The charity explains that the person can work for them, but they will first need to exercise their subject access rights and provide the charity with their criminal record before they can start. The charity is likely to have committed an offence.

What is a relevant record?

A ‘relevant record’ is a record which has been, or will be, obtained by a person exercising their right of access and:

is a health record;
contains information about a conviction or caution; or
contains information about a statutory function of that person.

A ‘health record’:

consists of information concerning health; and
has been made by or on behalf of a health professional (eg a doctor, dentist or nurse) in connection with the diagnosis, care or treatment of the person it relates to.

‘Information about a conviction or caution’:

consists of information processed by the police, the Director General of the National Crime Agency or the Secretary of State; and
relates to a conviction or to a caution issued against a person.

‘Information relating to a statutory function’:

consists of information processed in connection with certain statutory functions of:
- the Secretary of State,
- the Department for Communities in Northern Ireland,
- the Department of Justice in Northern Ireland,
- the Scottish Ministers, or
- the Disclosure and Barring Service or the independent reviewer appointed under section 12 of the Age of Criminal Responsibility (Scotland) Act 2019; and
relates to:
- prisons and prisoners,
- the detention of a person aged under 18 who was convicted of murder or another serious offence,
- social security contributions and benefits (eg statutory sick pay or accident insurance), and the administration of such matters,
- jobseeker’s allowance and related schemes,
- employment and support allowance on grounds of incapacity or disability,
- universal credit (England, Scotland and Wales only),
- criminal records history, and
- the vetting and barring of those who wish to work with children or vulnerable adults.

Example

A person applies for a job as an office receptionist. The employer offers the person the job, on the condition that they exercise their subject access rights and provide the employer with details of their benefits entitlements during a period of unemployment. The employer is likely to have committed an offence.

What does 'require' mean?

If you ‘require’ a person to do something, you ask, order, demand or command them to take a specific action. This means that you instruct them to do something and make it clear, either directly or indirectly, that you expect them to take this action.

You may also make it clear that if they do not take the specified action, this may result in a negative outcome for them, or they may be less likely to achieve an objective. For example, you suggest or imply that a particular action is necessary to achieve a particular purpose or objective, or that the action is likely to help them in some way to achieve the objective or avoid an undesirable outcome.

If you are an employer, you are in a position of power over your employees and over people who want you to employ them. So, if you require an employee or job seeker to do something, they may feel obliged to take the action or believe that if they don’t, they will be negatively affected. This is the case whether or not the person is happy to take the action in question.

You have required another person to make a SAR if you:

know that, in the circumstances, it would be reasonable for the other person to feel obliged to comply with the request; or
are reckless as to whether, in the circumstances, it would be reasonable for the other person to feel obliged to comply with the request.

A person may also feel obliged to make a SAR if they would:

be left in a detrimental position by not making a SAR; or
miss out on an incentive by not making a SAR.

There may also be other circumstances in which you require someone to make a SAR.

Example

A person applies for a job and is successful. Their potential employer informs them that they will be given the job whether or not they make a SAR for their criminal record. However, the potential employer explains that if they do not make a SAR, their annual salary will be lower than the advertised rate. This would obviously leave the person in a detrimental position if they did not make a SAR.

The offence is the act of requiring a person to make a SAR. The requirement is enough – whether you have committed an offence is not dependent on, for example, withdrawing an offer of employment or the provision of goods, facilities or services.

Asking a person to make a SAR means you have required them to do so. This still applies, even if you give a choice between them making a SAR and you accessing the information through an appropriate and lawful channel.

Are there any exemptions?

It is not a criminal offence for you to require a person to make a SAR if you can prove that:

it was required or authorised by another piece of legislation, a rule of law or by order of a court or tribunal; or
it can be justified as being in the public interest.

Given the importance of the right of access as a core right within the UK GDPR, you need an extremely strong justification that enforced subject access is in the public interest, supported by clear, specific and convincing evidence. This may be difficult to achieve, as clear public policy and laws exist about criminal record checking and access to medical records.

You cannot use the defence that an enforced SAR is in the public interest if your basis is that the public interest relates to the prevention or detection of crime.

What are the penalties?

A person who requires someone to make a SAR may be committing a criminal offence. This is an offence which can be heard either by a magistrates’ court or a crown court, in England, Wales and Northern Ireland. In Scotland, it will be heard in a sheriff court.

Committing such an offence in England and Wales can carry an unlimited fine, while in Scotland the fine can be unlimited if heard under solemn procedure or £10,000 for less serious offences under summary procedure. In Northern Ireland, the maximum fine if convicted under a summary offence is £5,000, or if convicted on indictment, the maximum fine is unlimited (unless expressly limited by statute).