When responding to Subject Access Requests, organisations must carefully navigate Article 15(4) of the GDPR, which explicitly protects the rights and freedoms of others. This provision creates a legal framework that prevents requesters from obtaining information that would adversely affect third parties, requiring controllers to strike a delicate balance between transparency and privacy protection.
Article 15(4) states that the right to obtain a copy of personal data "shall not adversely affect the rights and freedoms of others." While seemingly straightforward, this clause presents significant practical challenges during SAR processing, particularly when personal data is intertwined with information about colleagues, clients, or other individuals who have not consented to disclosure.
What Article 15(4) Protects in Practice
The Article 15(4) provision serves as a safeguard mechanism that allows organisations to withhold or redact information where disclosure would infringe on the rights of third parties. This extends beyond simple privacy concerns to encompass intellectual property rights, commercial confidentiality, and legal privilege in certain circumstances.
Third party personal data represents the most common category requiring protection under this provision. When an employee requests emails, for instance, those communications often contain references to or information about other staff members, clients, or external contacts who have their own privacy rights that must be respected.
Identifying Third Party Information
Third party data within SAR responses typically includes:
- Names, contact details, and identifying information of other individuals
- Performance assessments or opinions about colleagues
- Witness statements or complaints made by other parties
- Medical information about family members or dependents
- Commercial information about clients or business partners
Not all mentions of third parties require redaction. The key test is whether disclosure would adversely affect that person's rights and freedoms, not merely whether their information appears in the record.
How Article 15(4) Interacts with Redaction Obligations
The practical application of Article 15(4) requires controllers to make nuanced judgments about when third party information can be disclosed and when it must be protected. This decision-making process forms a critical part of determining what can be redacted from a SAR.
The ICO guidance clarifies that organisations should consider whether the third party has consented to disclosure, whether the information is already in the public domain, and whether disclosure would cause substantial damage or distress to the third party. These factors help determine the proportionality of withholding information.
When assessing whether Article 15(4) applies, consider whether you could reasonably redact the third party information while still providing meaningful disclosure to the requester. Blanking out names or contact details often preserves both transparency and third party privacy.
Balancing Competing Rights Under Article 15(4)
Article 15(4) does not create an automatic exemption from disclosure. Instead, it requires a balancing exercise between the requester's access rights and the legitimate interests of third parties. Controllers must demonstrate why withholding specific information is necessary and proportionate.
This balancing test becomes particularly complex in employment contexts, where SARs from former employees often seek information about disciplinary proceedings, grievances, or redundancy decisions that inevitably reference other staff members or decision-makers.
The Proportionality Assessment
When determining whether Article 15(4) justifies withholding information, organisations should consider:
- The nature and sensitivity of the third party information
- Whether the third party has a reasonable expectation of confidentiality
- The relationship between the requester and the third party
- Whether redaction could achieve both transparency and protection
- The context in which the information was created or collected
Documentation of this assessment process is essential. If a requester challenges your decision or escalates to the ICO, you must be able to demonstrate that you conducted a proper balancing exercise rather than applying blanket redactions.
Common Scenarios Where Article 15(4) Applies
Understanding how Article 15(4) operates in specific contexts helps organisations apply the provision consistently and defensibly. Different scenarios present varying levels of complexity in balancing competing rights.
In workplace investigations, statements provided by witnesses or complainants typically qualify for protection under Article 15(4). Those individuals provided information with an expectation of confidentiality, and disclosure could expose them to detriment or discourage future cooperation with investigations.
Performance management records frequently contain third party evaluations, feedback from colleagues, or comparative assessments. While the requester has a legitimate interest in understanding decisions affecting them, this must be weighed against the privacy rights of those who provided candid assessments.
Healthcare and Family Contexts
In healthcare settings, Article 15(4) becomes particularly relevant when patient records contain information about family members, carers, or other patients. Medical records might reference a spouse's health conditions, a child's medical history, or observations about household members that fall within their own privacy rights.
The fact that information appears in the requester's file does not automatically make it their personal data if it primarily relates to someone else. Controllers must distinguish between information about the requester and information about third parties that happens to be stored alongside requester data.
Documenting Article 15(4) Decisions
When relying on Article 15(4) to withhold or redact information, organisations must create an auditable record of their decision-making process. This documentation serves both compliance and defensive purposes if decisions are later challenged.
Your redaction log should identify each instance where Article 15(4) was applied, specifying what information was withheld, why disclosure would adversely affect third party rights, and what balancing considerations were assessed. This level of detail demonstrates thoughtful application rather than blanket refusal.
The time pressures associated with SAR deadlines can make thorough documentation challenging, but understanding when you can extend SAR deadlines may provide additional time for complex cases involving significant third party information.
Create a standard template for documenting Article 15(4) decisions that includes fields for: information withheld, third party affected, nature of adverse effect, balancing factors considered, and decision outcome. This ensures consistency and completeness across your SAR responses.
When Article 15(4) Does Not Apply
Understanding the limits of Article 15(4) is equally important to avoid over-redaction. The provision cannot be used simply because disclosure might be inconvenient or embarrassing to third parties; there must be a genuine adverse effect on their rights and freedoms.
Information that third parties have voluntarily made public, such as published statements or public social media posts, generally cannot be withheld under Article 15(4). Similarly, purely factual information like meeting attendance or job titles typically does not qualify for protection unless specific circumstances create privacy concerns.
The requester's own contributions to communications or documents remain disclosable even when third parties are also referenced. An email exchange between the requester and a colleague, for instance, should be disclosed with the colleague's personal details redacted rather than withheld entirely.
Communicating Article 15(4) Decisions to Requesters
When you redact or withhold information under Article 15(4), transparency about your reasoning helps manage expectations and reduces the likelihood of complaints. Your response should clearly explain that you have applied this provision and provide sufficient detail about why, without disclosing the very information you are seeking to protect.
Generic statements that "some information has been redacted to protect third parties" offer insufficient transparency. Instead, specify categories of redacted information (such as "names and contact details of other employees" or "medical information about family members") and cite Article 15(4) as your legal basis.
This level of communication demonstrates compliance with your accountability obligations under GDPR and helps requesters understand that redactions are legally justified rather than arbitrary attempts to withhold information.
Need expert SAR redaction support?
Our specialist team delivers defensible redaction with a full audit trail. Fixed fee, on your case within 24 hours, from £495 per case.
Get Your Free SAR Assessment →Frequently Asked Questions
What does Article 15(4) of UK GDPR say?
Article 15(4) states that the right to obtain a copy of personal data shall not adversely affect the rights and freedoms of others. It is the legal basis for withholding third-party information from a SAR response where disclosure would prejudice another individual's rights.
Does Article 15(4) mean I must always redact third-party names?
No. Article 15(4) requires a balancing exercise, not automatic redaction. You must weigh the requester's right of access against the third party's rights, considering the type of information, any duty of confidentiality, whether consent was sought or refused, and whether the third party could be identified from the information.
Can I refuse a whole SAR under Article 15(4)?
No. Article 15(4) permits withholding specific information whose disclosure would adversely affect others — it does not permit refusing a request outright. Blanket refusals citing third-party rights are a common ICO complaint and rarely withstand scrutiny.