They said this… · Data protection & SARs

“Internal emails are never included in a SAR”

Generally incorrect

Internal emails can contain the requester’s personal data and are not categorically excluded merely because they are internal.

Not sure which right applies? Check your situation →

Why this answer

What actually matters

  • The right is to personal data, not automatically to every whole document.
  • Exemptions and third-party rights can affect what is disclosed/redacted.
  • Search scope should include relevant systems where personal data is likely to be held.

What you could say

Keep the response tied to the actual rule.

Evidence

What to have beside you

  • Original request/complaint and proof of receipt
  • Every ID, clarification or extension message
  • A list of data categories you know or reasonably expect to exist
  • The response pack, redactions, file metadata and missing categories

If they still refuse

Move the dispute forward.

  1. Challenge the controller precisely: identify the missing data, disputed accuracy or rule you say has been misapplied.
  2. Use the organisation’s data-protection complaint route where appropriate.
  3. The ICO can consider data-protection compliance, but compensation normally requires a different route.

Read the full rules

Go deeper before escalating.

Primary guideRead the detailed ConsumerWise guidance.Subject access requestsRead the full guide.Challenging a SAR responseRead the full guide.Data accuracyRead the full guide.