Freedom of Information request - FOI for Subject Access Request information
Case reference FOI2026/00142
Received 3 February 2026
Published 23 February 2026
Request
Under the Freedom of Information Act 2000, I am writing to request information regarding Subject Access Requests (SARs) received by your Council.
For ease of response, I have structured this request into clearly defined questions with simple response formats. Where exact figures are unavailable, informed estimates are acceptable.
Section 1: SAR Volume
Please provide the total number of Subject Access Requests received:
Financial Year Number of SARs Received
2022/23 (April 2022 - March 2023)
2023/24 (April 2023 - March 2024)
2024/25 (April 2024 - March 2025)
Section 2: Processing Time and Staff Costs What is the estimated average number of staff hours spent processing each SAR (including searching, collation, review, and redaction)?
Average hours per SAR?
Which salary band best represents the staff primarily responsible for processing SARs?
(Select one)
☐ Under £30,000 per annum
☐ £30,000 - £40,000 per annum
☐ £40,000 - £50,000 per annum
☐ £50,000 - £65,000 per annum
☐ Over £65,000 per annum
☐ Mixed/varies significantly across departments
Approximately how many FTE (full-time equivalent) staff are dedicated to SAR processing?
Estimated FTE for SAR processing =
Section 3: External Costs
Please provide the total expenditure on external SAR support (e.g., solicitors, consultants, redaction services) Costs can be approximate however must be indicated as such:
Financial Year External Spend (£)
2022/23
2023/24
2024/25
If no external services were used, please state "Nil".
Section 4: Compliance and Timeliness
Please provide the following compliance data:
Financial Year Completed Within 30 Days Required Extension Total SARs
2022/23
2023/24
2024/25
How many SARs are currently open or overdue?
Current backlog (open/overdue) =
Section 5: Complaints and Quality
Please provide the following quality indicators:
Financial Year ICO Complaints SARs Requiring Re-work
2022/23
2023/24
2024/25
If none, please state "Nil".
Has the ICO taken any enforcement action regarding SAR handling in the past three years?
☐ Yes ☐ No
Section 6: Current Tools and Methods
What software or tools are currently used to manage and process SARs? (Select all that apply) ☐ Spreadsheet (e.g., Excel, Google Sheets) ☐ General case management system ☐ Specialist SAR/DSAR software. Name of software__________________________
☐ Social Care Case Management System (e.g., Liquid Logic, Mosaic) ☐ Document Management System (e.g., SharePoint, OpenText) ☐ Email/manual process only ☐ Other (please specify): _______________
Is any element of your SAR process currently automated? (Select all that apply) ☐ Automated searching across systems ☐ Automated redaction ☐ Automated tracking and deadline alerts ☐ Automated response/correspondence generation ☐ No automation currently in place
Section 7: SAR Processing Responsibility Which role(s) or department(s) are primarily responsible for processing SARs? (Select all that apply) ☐ Information Governance Team ☐ Data Protection Officer / DPO ☐ Legal Services ☐ HR / People Services ☐ Children's Services ☐ Adult Social Care ☐ Individual service departments (for records within their area) ☐ External provider ☐ Other (please specify): _______________
Name the top 3 departments to which SARs were aimed.
1
2
3
Section 8: Complexity Indicators
On average, how many separate systems are searched per SAR? (Select one)
☐ 1-2 ☐ 3-5 ☐ 6-10 ☐ More than 10
On average, how many pages are reviewed per SAR? (Select one)
☐ Under 50 ☐ 50-200 ☐ 201-500
☐ 501-1,000 ☐ Over 1,000 ☐ Unknown
How many SARs required consultation with third parties (e.g., NHS, schools, police, external agencies)?
Financial Year Third Party Consultations
2022/23
2023/24
2024/25
If any part of this request cannot be answered, please provide what information is available and explain why the remainder is not held or exempt.
I would prefer to receive this information electronically.
Response
Your request for details under the Freedom of Information Act 2000 has been considered. Please see information below:
|
Request |
Response |
|
Under the Freedom of Information Act 2000, I am writing to request information regarding Subject Access Requests (SARs) received by your Council. |
|
|
Section 1: SAR Volume |
· 2022/23 (April 2022 - March 2023) 5 · 2023/24 (April 2023 - March 2024) 4 · 2024/25 (April 2024 - March 2025) 9 |
|
Section 2: Processing Time and Staff Costs What is the estimated average number of staff hours spent processing each SAR (including searching, collation, review, and redaction)? |
What is the estimated average number of staff hours spent processing each SAR (including searching, collation, review, and redaction)? Information not held - The Council does not hold recorded information on the average number of staff hours spent processing Subject Access Requests. Time spent on SARs is not time-recorded by the Information Governance Team, the Data Protection Officer or individual services involved in searching, reviewing and collating information, and therefore no reliable average can be provided.
Which salary band best represents the staff primarily responsible for processing SARs? Mixed/varies significantly across departments – as explained above
Approximately how many FTE (full-time equivalent) staff are dedicated to SAR processing?
The Council does not record SARs or associated internal reviews on a dedicated FTE basis, as this work is delivered through a distributed model and no officers are solely assigned to it. Currently, Executive Assistants coordinate requests alongside their wider roles, with oversight from a Team Manager, specialist advice from the Senior Information Governance Officer, and assurance from the DPO, while service areas undertake reasonable and proportionate searches and redaction subject to IG review. As this activity varies by complexity and is spread across multiple roles, it cannot be accurately expressed as a single FTE figure and is therefore not recorded. |
|
Section 3: External Costs |
Nil |
|
Section 4: Compliance and Timeliness |
Financial Year Completed Within 30 Days
Required Extension Total SARs
How many SARs are currently open or overdue?
How many SARs are currently open or overdue? 6
|
|
Section 5: Complaints and Quality |
2022/23 None
Has the ICO taken any enforcement action regarding SAR handling in the past three years? |
|
Section 6: Current Tools and Methods |
The Council has considered this request on a case-by-case basis and is satisfied that the information sought, which relates to the systems, software and processes used to manage Subject Access Requests, falls within the categories of IT infrastructure, software and cyber-security information described in the Council’s published Freedom of Information guidance. The Council considers that the exemption at section 31(1)(a) and section 31(3) of the Freedom of Information Act 2000 is engaged.
The Council has applied the prejudice test and public interest test and concludes that confirming or denying whether such systems or automated processes are in place would, or would be likely to, prejudice the prevention or detection of crime by exposing information that could be used to identify or exploit vulnerabilities within the Council’s systems. On balance, the public interest lies in neither confirming nor denying whether the requested information is held.
See here for the published guidance referred to above: Freedom of Information - Freedom of information requests | South Derbyshire District Council
Is any element of your SAR process currently automated? No automation currently in place |
|
Section 7: SAR Processing Responsibility Which role(s) or department(s) are primarily responsible for processing SARs? (Select all that apply) ☐ Information Governance Team ☐ Data Protection Officer / DPO ☐ Legal Services ☐ HR / People Services ☐ Children's Services ☐ Adult Social Care ☐ Individual service departments (for records within their area) ☐ External provider ☐ Other (please specify): _______________ |
The Council’s approach is that responsibility for Subject Access Requests is shared across the organisation. In line with the Council’s internal procedures, all services are responsible for identifying, responding to and providing substantive information for Subject Access Requests relating to records held within their service areas. The Council takes its obligations under Article 15 UK GDPR seriously and expects all officers to play an active role in ensuring requests are handled lawfully, accurately and within statutory timescales.
The Information Governance Team and the Data Protection Officer have primary responsibility for providing oversight and assurance, including advising on the lawful application of exemptions, reviewing and approving redactions where required, and ensuring compliance with data protection legislation before responses are issued.
Name the top 3 departments to which SARs were aimed.
Customer Services – 6 Housing Services – 6 Corporate Resources – 4 |
|
Section 8: Complexity Indicators |
Information not held - The Council does not hold recorded information on the average number of systems searched or pages reviewed per Subject Access Request. This information is not centrally recorded, as individual services manage their own records across different systems and the scope and volume of each request varies significantly.
How many SARs required consultation with third parties (e.g., NHS, schools, police, external agencies)? |
Documents
This is South Derbyshire District Council's response to a freedom of information (FOI) or environmental information regulations (EIR) request.
You can browse our other responses or make a new FOI request.