Receiving a Subject Access Request from a solicitor on behalf of an individual is a signal that deserves careful attention. It does not change your legal obligations under UK GDPR — you must still respond fully and within one calendar month — but it almost always means the individual has taken formal legal advice and is preparing to use whatever information they receive.
Understanding what this means for your response — and what it does not change — is essential to handling it correctly.
Can a Solicitor Submit a SAR on Someone's Behalf?
Yes. Under UK GDPR, a data subject can authorise a third party to exercise their rights on their behalf. This includes solicitors, legal representatives, trade unions, advice organisations, or any other individual or body the data subject has properly authorised.
A SAR submitted by a solicitor with proper authority carries exactly the same legal weight as one submitted directly by the individual. Your obligations — and your deadline — are identical.
A SAR from a solicitor is not a different type of request. The same rules, the same deadline and the same disclosure obligations apply as if the individual had written to you directly.
The First Thing to Check: Authority to Act
Before responding, you are entitled — and it is good practice — to confirm that the solicitor has proper authority to submit the SAR on behalf of the individual. In practice, this means requesting:
- Written confirmation from the solicitor that they are acting on behalf of the named data subject
- A signed authorisation or letter of authority from the individual confirming that they have instructed the solicitor to make this request
This is a reasonable and standard step. However, it should be done promptly and must not be used as a delaying tactic — the clock is running from the date the request was received, and using an authority check to stall the response would itself be a breach of UK GDPR.
In practice, most solicitors will include a signed authorisation with the SAR. If they do not, contact them immediately and request it — but continue your internal preparation in parallel rather than waiting.
Do not use the authority verification step as a reason to put the SAR to one side. The one-month deadline is running regardless. Begin your internal scoping and data collection process while authority is being confirmed.
What Does a Solicitor SAR Usually Mean?
A solicitor submitting a SAR on behalf of a client is almost always a sign that the individual is involved in, or preparing for, a formal dispute. The most common contexts include:
- Employment disputes — unfair dismissal, discrimination claims, grievance appeals, redundancy challenges or settlement negotiations. A SAR is routinely one of the first steps an employment solicitor takes before proceedings begin.
- Personal injury claims — claimants' solicitors may submit SARs to healthcare providers, employers or insurers to obtain records relevant to an injury claim
- Financial disputes — credit decisions, mis-selling complaints, insurance disputes or professional negligence claims where an individual's data is relevant evidence
- Housing or tenancy disputes — landlords or letting agents may receive SARs from tenants seeking correspondence and records relevant to a deposit dispute or eviction challenge
- Data protection complaints — where an individual believes their data has been misused and a solicitor is helping them build a claim under Article 82 of UK GDPR
The solicitor's letter may or may not make the underlying dispute explicit. Even if it does not, the fact that legal representation has been obtained is a strong indicator that the individual intends to use the SAR response as evidence.
Does the Litigation Context Change What You Must Disclose?
No. Your disclosure obligations are determined by UK GDPR, not by whether the individual is involved in litigation. You must provide the same data you would provide to any other data subject making the same request.
The temptation — particularly when a dispute is already underway — is to respond narrowly, disclosing as little as possible. This is almost always counterproductive. An incomplete response to a solicitor SAR is likely to be spotted, challenged and escalated. The solicitor will know what data is likely to exist, and an evasive response will invite an ICO complaint and potentially a court order for disclosure.
Respond fully and accurately, apply redactions only where a specific legal basis exists and is properly documented, and ensure the response reflects a genuine good-faith effort to comply.
Legal Privilege: Your Most Important Protection
In litigation-adjacent SARs, the exemption that typically matters most is legal professional privilege. Communications between your organisation and your own solicitors — advice on the dispute, strategy documents, instructions and opinions — are protected from disclosure and can be redacted.
However, privilege must actually apply. Not every document that mentions a solicitor is privileged. The privilege belongs to the advice-giving relationship, not to any communication that happens to be copied to a lawyer. To withhold material on privilege grounds you need to be confident the privilege genuinely applies, and the redaction should be documented in your redaction log with the specific basis.
You should involve your own legal advisers in the privilege assessment for any SAR where litigation is in play. This is one of the situations where specialist support — both data protection and legal — is most valuable.
Received a SAR from a solicitor?
We handle the complete response process — document collection across all systems, AI-assisted review, defensible redaction with a full privilege and exemptions log, and a disclosure pack ready to send. Fixed fee, on your case within 24 hours.
Get a Free Quote →Where to Send the Response: The Individual or the Solicitor?
Where the solicitor has submitted the SAR on behalf of the data subject, you should direct the response to the solicitor — unless the data subject has expressly requested otherwise. The solicitor is acting as the individual's agent, and the response should go to them.
Your covering letter should still be addressed to the data subject by name, confirm the scope of what has been provided and what (if anything) has been withheld, and set out the individual's right to complain to the ICO if they believe the response is incomplete.
Practical Steps: Responding to a Solicitor SAR
- Acknowledge immediately — confirm receipt, request authority documentation if not already provided, and note the deadline
- Alert your legal team — if litigation is in play or anticipated, your solicitors should be aware of the SAR from the outset so they can advise on privilege and disclosure strategy in parallel
- Begin data collection without delay — do not wait for authority confirmation before starting your internal search
- Apply privilege carefully — redact only where privilege genuinely applies, document every redaction
- Respond fully and in good faith — an incomplete or evasive response to a solicitor SAR will almost certainly be identified and challenged
- Keep a complete audit trail — your redaction log, your data sources, your review process and your correspondence with the solicitor should all be documented
Frequently Asked Questions
Do you have to comply with a SAR submitted by a solicitor?
Yes — provided the solicitor has proper authority to act on behalf of the data subject. Your obligations are exactly the same as if the individual had submitted the request themselves, including the one-month deadline.
Can you ask a solicitor to prove they have authority to submit a SAR?
Yes. You are entitled to request a signed authorisation from the individual before responding. This should be done promptly and must not be used to delay the response — continue your internal preparation while authority is confirmed.
Does a SAR from a solicitor mean litigation is coming?
Not necessarily — but it is a strong signal that the individual has taken formal legal advice and is taking a dispute seriously. In employment contexts particularly, solicitor SARs often precede tribunal claims. Your legal obligations are unchanged regardless of the litigation context.
Can you withhold information from a solicitor SAR because of legal privilege?
Yes — but only where privilege genuinely applies to the specific material being withheld. Communications between your organisation and your own solicitors regarding the dispute may be privileged. The privilege must be real, and every redaction must be documented with its basis. Involve your own legal advisers in this assessment.
Should the response go to the solicitor or the individual?
Where the solicitor has proper authority and has submitted the request on behalf of the individual, direct the response to the solicitor — unless the individual has requested otherwise. The covering letter should still address the data subject by name and explain their right to complain to the ICO.