5 ways organisations can make subject access requests less of an operational headache

From rising volumes to stretched teams, subject access requests are pushing organisations to rethink processes, reduce manual effort, and find more sustainable ways to respond

For many organisations, subject access requests (SARs) have quietly evolved from an occasional compliance task into a steady operational drain. As data volumes grow and communication channels multiply, what once felt manageable can now mean weeks of searching, reviewing and redacting – often under tight deadlines and with little room for error. Furthermore, the ICO (Information Commissioner’s Office) has noted a significant rise in complaints related to SARs, with the failure to respond being a primary driver for regulatory scrutiny and potential fines.

At the same time, awareness of data rights continues to grow among employees, customers and the public, resulting in requests that are not only more frequent but also more complex. Organisations are also seeing the “weaponisation” of SARs by disgruntled employees, bad actors, or even competitors seeking to overwhelm administrative functions or fish for sensitive information. Responding accurately and on time is no longer just about meeting regulatory requirements; it’s key to avoiding reputational damage and the risk of a data breach through a “problematic” response (such as accidentally disclosing a third party’s data).

Sam Dix, Senior Solutions Architect at Iron Mountain, says the scale of the challenge often surprises organisations when they take a step back and look at the full picture. “In large organisations with a lot of data, you can see thousands of SARs each month,” he says, adding that some organisations are still relying on highly manual processes.

“In some cases, teams are literally photocopying documents and using black pens to redact them – and every request is costing time and money,” he adds. These costs are often “hidden,” buried across HR, Legal, IT, and Finance budgets, masking the true financial impact of an inefficient process.

While there’s no silver bullet, organisations – including those working with providers such as Iron Mountain – are starting to rethink how they approach SARs, shifting from reactive firefighting to more structured, technology-assisted workflows. Here are five ways that shift is taking shape.

Recognising that SARs are an operational issue, not just a legal one

One of the biggest mindset changes is recognising that SARs aren’t simply a compliance box to tick. They span IT, legal, HR, and records management, often requiring coordination between teams that don’t typically work closely together.

As requests grow in volume and complexity, organisations are realising that ad-hoc approaches quickly become unsustainable. What might once have been handled by a small legal team can now require coordinated workflows, defined processes, and clearer ownership across departments. Without that structure, responding to requests can become inconsistent and difficult to scale.

That complexity is why many organisations end up dedicating entire teams to handling requests. Dix says it’s not unusual to see groups of a dozen or more people focused primarily on SAR workloads, particularly in data-rich sectors.

“Some organisations have teams of 15 people just working on SARs,” he says, adding that this burden isn’t something companies can simply write off as a capital expense.

Understanding the human impact

Beyond budgets and workflows, there’s a human dimension that often goes unspoken. SAR handling can involve repetitive, complex work in which mistakes carry regulatory risk, creating pressure on the teams responsible.

The need to balance speed with accuracy can make the work particularly demanding, especially when requests arrive in waves or involve large volumes of unstructured data.

Dix says organisations are increasingly acknowledging the toll this can take, something he says often comes up in conversations with Iron Mountain customers. “We’ve seen teams dealing with real anxiety because of the complexity,” he says. “A big part of the conversation now is how do we take that stress away and make the process more manageable.”

That shift is helping move SAR discussions beyond pure compliance to broader conversations about workload, well-being, and sustainability. As organisations seek to reduce pressure on teams, many are exploring how process improvements and technology can help create more predictable, manageable workflows.

Freeing skilled staff to focus on higher-value work

The operational burden is particularly visible in environments such as healthcare, where highly trained professionals may spend time on administrative data searches rather than on their core roles.

Across sectors, organisations are recognising the opportunity cost of having skilled employees tied up in manual data discovery tasks. By shifting the heavy lifting of SARs to a managed service, organisations can achieve better results while allowing their internal experts to concentrate on strategic initiatives rather than administrative work.

Dix points to NHS scenarios in which clinicians may be involved in responding to requests – a situation many organisations are keen to change. “When you can free people up to do the work they’re qualified to do, that’s a big win,” he says.

Reducing the manual effort required to locate and review data –  whether through internal process changes or managed services – not only speeds up responses but also helps ensure specialist staff aren’t pulled away from frontline responsibilities. Over time, this can improve both efficiency and job satisfaction, particularly in environments where workloads are already stretched.

Using technology to reduce manual effort – with humans still in the loop

Automation and AI are increasingly central to how organisations modernise SAR workflows, particularly in searching large volumes of unstructured data., Iron Mountain provides this as a comprehensive service, utilizing advanced technology to do the heavy lifting while maintaining a strict “Human-in-the-Loop” (HITL) approach.

Technology is helping organisations move away from manual searches and fragmented processes towards more consistent, repeatable workflows that can scale as volumes grow. By automating routine tasks, teams can focus more on review and decision-making rather than data gathering.

But Dix emphasises that technology works best when paired with human oversight. “We use technology to do a lot of the heavy lifting, but there are always humans checking over everything,” he says. “From a regulatory perspective, human involvement is really important to ensure defensibility and accuracy.”

This hybrid model allows organisations to scale their SAR response capacity up or down instantly based on demand, without the need to hire or fire permanent staff. This also enables organisations to balance efficiency with defensibility, so they can speed up processes without increasing risk. It also provides greater confidence that responses are accurate, complete, and appropriately reviewed.

Taking a more holistic view of information management

Finally, many organisations are realising that SAR challenges often reflect broader data management issues, from fragmented systems to large volumes of “dark data” that aren’t well understood or indexed.

As data continues to accumulate across cloud platforms, collaboration tools and legacy systems, organisations are finding that responding to requests effectively requires a clearer understanding of where information lives and how it is managed over time.

With a long history in information storage and management, Iron Mountain can help organisations take a more end-to-end approach, bringing together data discovery, processing and governance rather than treating each request as a standalone project.

“The difference for us is the human input alongside the technology – it’s essentially information as a service,” Dix says.

Taking a broader view of information management can help organisations not only respond to SARs more efficiently but also improve governance, reduce risk, and build greater confidence in their data practices overall.

As request volumes continue to climb, many organisations are taking a harder look at whether their current processes can realistically keep up. For some, that means rethinking workflows internally; for others, it means bringing in providers such as Iron Mountain to take some of the strain. Either way, the focus is shifting from simply getting responses out the door to making sure the process is workable for the people and budgets behind it.