Access request containing third-party data: redact instead of blanket refusal

An access request should not be refused in full merely because the records also contain information about other people. Article 15(4) GDPR requires the rights and freedoms of those people to be taken into account. In practice, that often calls for a separate review, redaction or a partly prepared copy of the personal data.

This article is for organisations handling an access request that includes emails, conversation notes, messages or other information about third parties. It focuses on identity checks, defining the data set, protecting third-party information, the one-month period and a clear response. The general handling of an Article 15 GDPR request remains a separate question.

Article 15(1) GDPR concerns personal data relating to the requester. A request may therefore be contained in an email, meeting note or case file that also refers to several other people. Start by identifying which information relates to the requester and which additional information under Article 15 is relevant to the response.

Organise the data set by processing activity, system and period. In emails or chat histories, the entire message is not automatically the same as a complete copy of a file. The response still has to address the personal data and the prescribed information about purposes, data categories, recipients, storage period, origin and the other data subject rights where relevant.

A request may also mention rectification, erasure or another request for documents. Record those issues separately. The general Article 15 GDPR access guide explains the overall process. This article focuses on the additional review required when search results contain information about other people.

Article 12(2) GDPR requires the controller to facilitate the exercise of data subject rights. Article 12(6) permits additional information where there are reasonable doubts about the identity of the natural person. The request for further information should therefore address a concrete identification risk and remain limited to what is required for that purpose.

First review the existing points of connection, such as a verified customer account, known contact details or prior correspondence. The more sensitive the data set and the greater the risk of disclosure to the wrong person, the more carefully the link must be checked. An identity-document copy should not become a standard response where a less intrusive method is sufficient.

Record receipt of the request separately from the later search time. Keep the request, follow-up, additional information received and identification decision with their dates. This makes the steps before disclosure traceable and supports a reliable organisational handling of the one-month period.

Article 15(4) GDPR limits the right to receive a copy where the rights and freedoms of other people would be adversely affected. It therefore calls for a concrete balancing exercise. It does not turn the phrase “third-party data” into an automatic block on the entire request.

For each result, record which information concerns the requester, which information describes another person and which interests may be affected. This can include contact details, private circumstances, personal assessments or statements in a communication. The response must reflect the specific content and the specific risk.

The review record should show why information is disclosed, separated or withheld. A label such as “third-party data” does not explain the decision. Nor does the fact that a document was created by or refers to several people settle the question. The relevant issue is the information itself and its effect on the rights of the other person.

Redaction can be an appropriate way to provide the data copy while withholding protected third-party information. It should be applied to the document and passage concerned. A completely blacked-out document can restrict the request as much as an uncontrolled full disclosure.

Check whether names, contact details or individual statements can be separated without losing the requester’s personal data and its meaning. Fields in a structured record may require different treatment. In longer messages, the requester’s information may need a short explanation while passages about other people remain protected.

The response should explain a partial disclosure in clear terms. Identify the data copy provided, describe remaining restrictions factually and keep the full reasoning in the internal record. The explanation must remain understandable without revealing the protected information again.

Article 12(3) GDPR requires action without undue delay and in any event within one month of receiving the request. Where necessary because of the complexity or number of requests, the period may be extended by up to two further months. The requester must be informed of the extension and the reasons within the first month.

Third-party data can increase the search and review work because individual documents and communication threads may require a separate assessment. That fact alone is not an explanation. Record which sources are involved, which protection review is required and why the handling is complex.

Where the controller does not take action, Article 12(4) GDPR requires notice without delay and at the latest within one month, including the reasons and information about the right to complain to a supervisory authority and seek a judicial remedy. A partial disclosure should therefore be accompanied by a clear explanation where content remains restricted.

Article 15(3) GDPR requires a copy of the personal data undergoing processing. Where the request is made electronically, the information should be provided in a commonly used electronic format unless the requester asks otherwise. A raw database export is not automatically a clear response.

Organise the data copy by source or processing activity and briefly explain the connection. Add the information under Article 15(1) that is relevant to the case. Check especially that redactions cannot be reversed and that file properties or comments do not disclose further third-party information.

Before sending, check the recipient, secure transmission, attachments and readability. The first copy is generally supplied free of charge. Further copies and manifestly unfounded or excessive requests are subject to the specific rules in Article 12(5) and Article 15(3) GDPR. Those questions must be decided separately from the protection of third-party information.

Start with a copy of the request and a receipt note. Record the data subject, communication channel, existing identification, requested data and any additional requests. Then define search sources, the period and the responsible teams.

Mark results containing information about other people and review them one by one. Record disclosure, separation, redaction or any remaining restriction with a short reason. The handling record should also show which third-party information is protected by the preparation.

The final record should contain the timing calculation, any extension notice, the data copy, the additional information, the transmission check and the explanation of restrictions. A legal review can help with complex messages so that protection of third parties neither unjustifiably limits nor overextends the access right.

We review the request, identification, search set, third-party information, redactions, timing, data copy and response against the actual process. For an initial assessment, please provide the request, affected systems, example results, planned preparation and previous communication. This helps complete the access review while protecting other people’s information in a traceable way.