What Is a Reasonable DSAR Response? Navigating ‘Proportionate Search’ in 2025

ICO SAR Guidance Summary

In 2025, privacy compliance isn’t about doing more—it’s about doing it right. Thanks to the UK’s Data Use and Access Act (DUAA) and evolving EU enforcement priorities, DSAR response standards are shifting. One term is at the center of it all: “reasonable and proportionate.”

What Is a Reasonable DSAR Response? Navigating ‘Proportionate Search’ in 2025

Introduction: Reasonableness Is the New Standard

In 2025, privacy compliance isn’t about doing more—it’s about doing it right. Thanks to the UK’s Data Use and Access Act (DUAA) and evolving EU enforcement priorities, DSAR response standards are shifting. One term is at the center of it all: “reasonable and proportionate.”

For privacy teams, this means rethinking old workflows. Over-processing is risky. Under-processing is legally dangerous. This blog explores what “reasonable” really means—and how to build workflows that are fast, fair, and defensible.

1. What the DUAA Actually Says

The DUAA introduces a pragmatic approach: organizations only need to search systems where personal data is likely to reside. The law formalizes the idea that a DSAR shouldn’t require a full-system crawl unless justified.

Key takeaways:

  • You can “stop the clock” during identity verification or request clarification

  • Excessive or unfounded requests can be paused or rejected

  • Legal privilege and context-based exemptions are now better defined

  • Controllers are expected to document why a system was searched—or not searched

2. GDPR vs DUAA: A Quick Comparison

Element DUAA (UK) GDPR (EU)
Search Scope Reasonable & proportionate Broad & inclusive
Timeline 30 days + pause allowances 30 days fixed
Redaction Expectations Context-based Full, detailed redaction required
Exemptions Legal privilege, excessive scope Limited and more rigid

If you’re a multinational business, your DSAR playbook must flex with region-specific rules—without compromising consistency or defensibility.

3. How Regulators View ‘Reasonable’

Regulators are looking for intentionality, not perfection.

They assess whether your team:

  • Scoped the request accurately

  • Logged the search decision process

  • Used a tiered review process based on risk

  • Communicated clearly with the requester

  • Built in controls for ID verification, redaction, and timelines

4. Operationalizing Proportionate Search

Here’s how leading orgs are making “reasonable” part of their DSAR DNA:

  • Maintain a data map of likely data sources

  • Tag systems by relevance to different data subjects

  • Use tiered workflows—basic requests fast-tracked, complex ones escalated

  • Create audit-ready logs of search decisions and exemptions

  • Train teams to recognize and respond to scope creep

Conclusion: Smart DSARs Are Defensible DSARs

In 2025, you don’t need to over-deliver. You need to prove you responded with care, structure, and logic.

The shift toward “reasonable and proportionate” is good news—if your workflows are ready for it.

Want help building defensible, efficient DSAR processes?
Explore how DSAR.ai supports modern workflows, documentation, and compliance readiness: www.dsar.ai