Can You Delete Data to Avoid a Subject Access Request?

Some subject access requests (SARs) mean a lot of work, especially when they cover CCTV footage, call recordings or years of email. Deleting the data can seem like the quickest way to handle the request.

In the UK, deleting data to stop it reaching the person who asked for it is a criminal offence. This guide explains the offence, two ICO prosecutions that show how it works, and what an organisation may still delete under its normal retention rules.

Key Takeaways

• Section 173 of the Data Protection Act 2018 makes it an offence for a controller, or anyone employed by or directed by the controller, to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure to a person who made a SAR and was entitled to receive it.

• The ICO prosecuted a care home director under section 173 in 2025. Beverley Magistrates’ Court fined him £1,100 and ordered him to pay £5,440 in costs. In 2020, a town clerk was prosecuted for deleting an audio recording after a freedom of information request; the court imposed a £400 fine and £1,493 in costs.

• Organisations may follow their normal retention schedule. The test is intention and timing: a deletion that would have happened anyway is a defence, and a deletion made to avoid answering a request is the offence.

Section 173 Makes Deleting Data to Avoid a SAR a Criminal Offence

Section 173 of the Data Protection Act 2018 applies where a person has made a request under a data subject access right and would have been entitled to receive information in response. The data subject access rights it covers include Article 15 of the UK GDPR (the right of access) and Article 20 (data portability).

In those circumstances, it is an offence for the controller, or for a person employed by the controller, an officer of the controller or someone under its direction, to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure of all or part of the information the requester was entitled to receive.

The wording covers more than deletion. Editing a record, hiding it from search or moving it somewhere staff cannot reach can all fall within it. It also applies to individual employees, so a manager who deletes a file personally carries the same risk as the organisation.

Two Defences Exist for Genuine Deletions

Section 173(5) gives a person charged with the offence two defences. The first applies if the alteration, blocking, erasure, destruction, or concealment would have occurred without a request. The second applies if the person reasonably believed the requester was not entitled to receive the information.

The first defence is the reason a retention schedule matters. A recording that the policy deletes after 30 days can be deleted on day 30 even if a request arrived on day 20, provided the deletion would have happened anyway, and the organisation can show it. The policy must be written down, applied consistently, and in force before the request arrived.

The ICO Prosecuted a Care Home Director Under Section 173 in 2025

In April 2023, a woman asked Bridlington Lodge Care Home in Yorkshire for her father’s personal information. She had a lasting power of attorney and asked for incident reports, copies of CCTV footage, and care notes.

According to the ICO’s enforcement page, the home’s director, Jason Blake, refused to respond. The ICO found that he blocked, erased, or concealed records the home held between 12 April and 12 May 2023 to prevent disclosure. The ICO says he did not explain why the organisation would not respond to the SAR during its investigation.

On 3 September 2025, he appeared at Beverley Magistrates’ Court, was found guilty, and was ordered to pay a £1,100 fine and £5,440 in costs.

A Town Clerk Was Fined for Deleting an Audio File in a Related Case

An earlier ICO prosecution involved the same idea under a different law. Nicola Young, the town clerk of Whitchurch Town Council, was convicted under section 77 of the Freedom of Information Act 2000. Someone asked for the audio recording of a council meeting because they believed the written minutes were inaccurate, and the council told them it had already deleted the file under council policy.

The ICO’s investigation found that Young, after initially denying it, knew about the request and deleted the file a few days later. In March 2020, she pleaded guilty at Crewe Magistrates’ Court and was fined £400, with costs of £1,493 and a victim surcharge of £40. The ICO described it as the first successful conviction under the Freedom of Information Act.

That case concerned freedom of information and not a SAR. It shows how the ICO and courts treat deletion after a request. The Act’s offence mirrors section 173: it covers anyone who erases or conceals a record to prevent disclosure.

Normal Retention Rules Still Apply Between Requests

Nothing in section 173 stops an organisation from deleting data on schedule. The storage limitation principle in Article 5(1)(e) of the GDPR and the UK GDPR requires organisations to keep personal data no longer than necessary, so deleting on schedule is both a legal duty and a permission.

The EDPB’s Guidelines 01/2022 on the right of access say the response should cover the data available when the request is received. Controllers are not required to provide data they previously processed and no longer hold, for example because they deleted it under their retention policy and statutory provisions.

The distinction comes down to timing and intention, and documenting both protects the organisation. Keep the retention schedule, apply it automatically where possible, and log when scheduled deletions run. When a SAR arrives, pause any ad hoc clean-up of the requester’s data until you send the response. A scheduled job that deletes the requester’s data after the request lands can still be questioned, so check what is due to run and decide whether to suspend it for that person’s records.

A Heavy SAR Has Lawful Ways to Reduce the Workload

The law offers several routes for large or hard-to-answer requests. In the UK, the ICO says you can ask the requester to clarify what they want where that is reasonably required, and the one-month clock stops on the day you ask and resumes the day after you receive the answer. You can extend the deadline by up to two further months if the request is complex or the person has made several requests. You must make a reasonable and proportionate search, and you do not have to carry out searches that are unreasonable or disproportionate to the importance of the information.

You can refuse or charge for a request that is manifestly unfounded or excessive, though the threshold is high. Third-party data can be redacted. Use these steps, and each leaves a record that you acted in good faith. Our guide to responding to a subject access request covers the procedure step by step.

Fines Under the GDPR: Add to the Risk

Outside the criminal offence, failing to answer a SAR properly breaches Article 15, and Article 83(5)(b) allows fines of up to €20 million or 4% of worldwide annual turnover for infringements of data subject rights. Deleting data to avoid a request also removes the records the supervisory authority will ask to see, which makes the organisation’s position harder to defend.

GDPRLocal helps organisations set retention schedules, build SAR procedures and handle large requests. See our GDPR consultant services and our Data Protection Officer service.

Conclusion

The rule is easy to state. Delete data on schedule, and never delete it just to avoid responding to a request. Section 173 makes the second a criminal offence for the controller and any employee who acts on its behalf, and the ICO has prosecuted it.

Lawful ways to manage a heavy request include clarification, extension, a reasonable search, redaction, and, for manifestly unfounded or excessive requests, a fee or refusal. An organisation that uses them and keeps a log of its retention and deletion decisions can show that it made its decisions for the right reasons.

Frequently Asked Questions

Is It a Crime to Delete Data After Receiving a SAR?

It is if you intend to prevent disclosure. Section 173 of the Data Protection Act 2018 covers altering, blocking, erasing, destroying, or concealing information to stop it from reaching the person who asked for it. Deleting data that was due for deletion anyway under a retention policy is a defence.

Can We Still Follow Our Retention Schedule While a SAR Is Open?

Yes, if the deletion would have happened anyway. The EDPB says the response covers the data available at the time of the request. Review what is scheduled to run against the requester’s records, document the decision and keep a log of what was deleted and when.

What Can We Do if a SAR Is Too Much Work?

Ask for clarification when reasonably required, extend the deadline by up to two months for complex or repeated requests, and conduct a reasonable, proportionate search. If the request is manifestly unfounded or excessive, you can charge a reasonable fee or refuse it, and you must be able to justify your decision.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.