Clarification can help locate data, but it cannot be used to force you to abandon a broad valid SAR.
The DUAA amendments allow controllers to pause the SAR time limit where clarification is reasonably required in order to respond. That power is narrower than “this request is large, please narrow it”.
A controller can ask for useful information such as which account, person, date range or system you mean where ambiguity genuinely prevents a reasonable response. If you decline to narrow a broad but intelligible request, the controller must still make the reasonable and proportionate searches required by law.
Key points
- Clarification must be reasonably required to respond.
- The controller should explain what needs clarification.
- The clock can pause under the current rules while genuinely necessary clarification is outstanding.
- Clarification and scope negotiation are not the same thing.
When clarification makes sense
If you ask for “all records about my complaint with Alex” and the organisation has four employees named Alex and several complaints, a question identifying the person or complaint may be necessary. If you ask for “all personal data held under account 123456”, the scope is already much clearer.
What if you want a broad search?
You can explain that the broad scope is intentional and provide search aids without relinquishing it. Useful search aids include former names, email addresses, phone numbers, reference numbers and known teams.
Recording the pause
Keep the clarification request and response date because they affect the statutory deadline. A controller should not retrospectively describe an ordinary email exchange as a clock-stopping clarification if it did not genuinely seek required clarification.
In practice
- Answer genuine ambiguity quickly.
- State expressly if you are not agreeing to narrow the legal scope.
- Offer identifiers and likely custodians to improve search quality.
What to do
A practical next-step plan
- Read exactly what the controller says is unclear.
- Answer the ambiguity without giving up relevant scope unless you choose to.
- Record the pause/resumption dates.
- Challenge any later assertion that you agreed a narrower scope if you did not.
Common traps
Things that often confuse the issue
- Do not accidentally write “yes, just HR” if you still need manager emails.
- Do not ignore a genuinely necessary clarification request.
- A broad request can still be valid even though the search effort must be reasonable and proportionate.
Evidence worth keeping
Challenge an artificial stop-the-clock decision.
Useful wording.
“My request already identifies [scope]. Please explain what is genuinely unclear and why clarification is reasonably required to provide an effective response. I do not agree that a preference for a narrower search, by itself, makes clarification necessary. If you maintain that the clock is paused, please record the date on which you say the pause began and the legal basis for doing so.”
If you provide clarification, do so promptly and preserve proof of receipt. If the eventual response remains incomplete, challenge the search separately rather than re-arguing the clarification point alone.
Clarification does not convert the SAR into a negotiation over convenience.
You can voluntarily narrow a request to obtain the most important records faster, but be explicit if you are doing so. If you do not intend to abandon the wider request, do not casually agree wording that could be read as replacing it. Ask the controller to confirm the agreed scope in writing.
Clarification can pause the response clock, so record the dates.
Where valid clarification is sought, the time limit can be paused until you provide it. Keep the original request date, the clarification request and your reply. The controller should not use an unnecessary clarification question as a device to manufacture extra time.
| If they ask… | Consider replying… |
|---|---|
| “What do you want?” | Restate the categories/systems/date range already specified and ask what remains genuinely unclear. |
| “Please limit this to one department.” | Explain whether that would omit personal data within the original scope; narrowing is your choice unless clarification is genuinely required. |
| Specific ambiguous account/date question | Answer promptly if it genuinely helps identify the requested personal data. |
A controller may seek clarification only where it is reasonably required.
Current ICO guidance says an organisation may ask you to clarify what personal information you want, for example where it holds a large amount of information or the request is vague, but clarification should only be sought if reasonably required to provide an effective response. It cannot simply force every requester to narrow a broad but understandable SAR because the search is inconvenient.
Official sources
Check the rules behind this guide
These are official or primary sources for this topic. Rules, scheme terms and deadlines can change, so check the live source before relying on a formal time limit or procedure.