How do I know if my DSAR search was complete?

You rarely can be certain. A practical check is to read what you have gathered and list every record it refers to, such as reports, meeting notes, letters and referrals, then confirm that each one is either in the response or has a recorded reason for being left out.

Do we have to find every document that mentions the person?

You must make a reasonable and proportionate search. The right of access covers the requester's personal data, not every document that mentions them, so you also need to decide whether each record contains their personal data.

What if a record we found mentioned no longer exists?

Record that you looked for it and why it could not be supplied, for example because your retention period had ended. Do not delete anything after you have received the request to avoid disclosing it.

Can AI confirm that a DSAR response is complete?

No. AI can point out records your documents mention, but it cannot see a record nobody refers to, and it cannot judge whether a search was reasonable. A person has to decide.

DSAR AI GDPR Compliance

Is Your DSAR Response Complete? How to Find the Records Your Documents Point To

A practical check to run before you reply to a subject access request: use the documents you already hold to find the records you have not supplied, and record what you decided.

November 5, 2026 • 4 min read

Short answer

Before you reply to a subject access request, read what you have gathered and list every record it refers to. Then check each one: is it in the response, or do you have a recorded reason why not? It takes little time, and it finds the gaps a requester is most likely to notice.

Why this check works

Most searches start from systems: the mailbox, the HR file, the case system. That finds what you thought to look for. It misses what you did not know existed.

Documents point to each other, though. An email says “as discussed in the 1:1”. An outcome letter says “having considered the investigation report”. Those references are a map of records connected to the person, and you already have them.

The requester often knows about those records too. If they attended the meeting, they may well ask where the notes are.

How to run the check

1. Read for references, not for content. Go through what you have and note every mention of another record. Look for words like report, notes, minutes, letter, referral, assessment, as attached, as discussed and see below.

2. Note where you found each one. Keep the document and the quote. It speeds up the next step, and it shows your reasoning later.

3. Check each record against the response. It is usually one of these:

What you find	What to do
It is already in the response	Nothing more
You hold it, but it was not gathered	Add it, then review and redact as normal
It sits with someone else in your organisation	Ask them for it
It is held by a processor for you, such as a payroll provider	Ask the processor; it is still your responsibility
It no longer exists	Record that you looked, and why it is gone
It has no personal data about the requester	Record why it is out of scope
An exemption may apply	Take advice if needed, and record the decision

4. Follow new references once. A record you add may mention others. Check those too, but be proportionate. You need a reasonable search, not an endless one.

5. Write it down. Under Article 5(2) you have to be able to show compliance. A short note of what you checked and decided is your evidence if the requester complains to a regulator.

What this check does not cover

It only finds records someone mentioned. It will not find a file no document refers to, so it adds to your search and does not replace it. Start with the systems the person’s data is likely to be in, including Microsoft 365 if you use it.

Finding a record does not settle whether to disclose it either. It may hold other people’s data, which you need to consider under Article 15(4). And the documents are only part of a complete reply: you also need to give the Article 15(1) information.

Where AI helps, and where it stops

This check is slow by hand when a case runs to hundreds of pages, and at the end of a long case it is often the step that gets skipped. Reading for references is something AI does well, as long as a person still makes each decision.

SAR Portal’s AI review does this on a case. It lists records your documents mention that have no matching file, with the document and the quote for each, and you confirm or dismiss them. It also lists documents that could not be checked for other people’s data.

It cannot tell you the response is complete. Nothing can. It gives your reviewer a list to work through, instead of relying on someone remembering a line on page 40.

Check your next response before you send it. Start a free trial or see how the AI review works.