Access rights concern personal data, not every document
A subject access request covers personal data about the requester, not every document that mentions a topic.
It is often used as a general disclosure tool and it is narrower than that. It also has limits where other people's personal data is entangled, or where legal privilege applies. Understanding the actual scope prevents both over-disclosure, which harms third parties, and reflexive refusal, which is unlawful.
More on UK GDPR
- Lawful basis is the reason processing is permittedIt will not turn without the reason
- Consent is one lawful basis, not the default answerOne setting out of six
- Erasure is not an absolute delete buttonIt will not travel the whole way
- Data portability is narrower than a database exportOnly what fits the frame
- Rectification requires organisations to be able to correct inaccurate personal data wherever it is maintainedCorrect it once, then chase every copy
- Restriction can pause use without erasing dataStopped, not shredded