Missing SAR data challenge

Make it evidence-led

“I know you have more” is weaker than identifying the missing category.

A SAR response is not incomplete merely because it does not contain a document you hoped to see. Focus on personal data that appears missing and explain why you think it should exist: a call you made, an email quoted elsewhere, a known account note, a status change or another record that points to it.

List missing categories separately.
Give dates, people, systems or events that help identify the data.
Distinguish “not found” from “withheld”, “deleted”, “outside scope” or “omitted”.
Ask for a renewed search where there is a concrete reason to do so.

Editable template

Version 1: apparently incomplete SAR response

Use this after a SAR disclosure where identifiable categories of personal data appear to be missing.

How to edit it: replace everything in square brackets with your own details. If a bracketed paragraph does not apply, delete it before sending.

Subject: Subject Access Request: apparently missing data: [SAR reference]

Dear Data Protection Team,

Thank you for your SAR response dated [date]. I do not consider the response complete because the following personal data appears to be missing or unexplained.

Missing category 1
What appears to be missing: [call recording / note / email / audit event / complaint record / other personal data]
Relevant date(s): [date/range]
Why I believe it may exist: [for example, another document refers to it / I made the call / your response quotes it]

Missing category 2
What appears to be missing: [category]
Relevant date(s): [date/range]
Why I believe it may exist: [reason]

Please review these categories and confirm, for each one, whether the relevant personal data was:
• found and will now be provided;
• not found after a reasonable and proportionate search;
• withheld or redacted on a particular basis; or
• no longer held.

Where helpful, please confirm the systems or record locations searched for the categories above, to the extent you can do so without disclosing information you are entitled to withhold.

[Optional: Please preserve records relevant to this unresolved request where they remain subject to ordinary retention and preservation obligations.]

Yours faithfully,
[Your name]

Editable template

Version 2: they say the response was complete

Use this when the organisation has simply said “we provided everything” but your identified evidence still points to a missing category.

How to edit it: replace everything in square brackets with your own details. If a bracketed paragraph does not apply, delete it before sending.

Subject: SAR follow-up: unresolved missing data: [SAR reference]

Dear Data Protection Team,

Thank you for confirming on [date] that you consider the SAR response complete. My concern is narrower than a general request for another search.

The unresolved category is: [describe the personal data].

Evidence indicating that this category may exist:
• [document/date/reference];
• [document/date/reference]; and
• [other evidence].

Your response says: [briefly quote or summarise their position].

That does not explain [why the identified record is absent / whether the record was searched for / whether it was withheld / whether it is no longer held].

Please therefore confirm the position on this specific category and explain the outcome of your search or the basis on which it has not been provided.

If you maintain that no further personal data is held, please treat this as a data-protection complaint about the handling of my SAR and provide the outcome of that complaint in accordance with your complaints process.

Yours faithfully,
[Your name]

Official & related guidance

Check the route that applies to your situation.

Check the linked guidance before sending. Rules, complaint stages and time limits can differ by sector.