SAR statistics 2025/26
Case reference FOI2026/02554
Received 21 October 2026
Published 4 November 2026
Request
Under the Freedom of Information Act 2000, please provide the following information relating to Subject Access Requests (SARs) made under the UK GDPR / Data Protection Act 2018 and received by the Council in the financial year 1 April 2025 to 31 March 2026. I would be grateful for the following:
1. The total number of SARs received.
2. The number of those SARs that were responded to within the statutory period (one calendar month, or up to three months where an extension was applied).
3. The number of those SARs that were responded to outside the statutory period.
4. The number of SARs that remain open and past their statutory deadline as at the date of this request.
5. The number of staff (full-time equivalent) whose primary role is handling SARs.
6. Whether the Council uses any software to manage SARs or to redact documents for disclosure, and if so, the name of the product(s) and the contract end date.
7. Whether the Council has, in the same period, received any correspondence from the Information Commissioner's Office concerning its SAR compliance, and if so the number of such complaints.
If any part of this request would exceed the appropriate cost limit, please provide the information for the remaining parts and advise which part is affected. I am content to receive the response by email.
Response
Under the Freedom of Information Act 2000, please provide the following information relating to Subject Access Requests (SARs) made under the UK GDPR / Data Protection Act 2018 and received by the Council in the financial year
1 April 2025 to 31 March 2026.
I would be grateful for the following:
1. The total number of SARs received.
Answer: 225.
2. The number of those SARs that were responded to within the statutory period (one calendar month, or up to three months where an extension was applied).
Answer:145. A further 28 were closed because the data subject did not provide ID or consent, or withdrew their request.
3. The number of those SARs that were responded to outside the statutory period.
Answer: 52
4. The number of SARs that remain open and past their statutory deadline as at the date of this request.
Answer: 11
5. The number of staff (full-time equivalent) whose primary role is handling SARs.
Answer: 5.6 FTE in the Information Governance team work on SAR’s, however, this is not their primary role. The team also handle other data subject requests, police and other organization requests, investigate data incidents and assess Data Protection Impact Assessments. They also answer queries from officers across the council regarding data protection, and produce policies / procedures / guidance on data protection and deliver training. The team also provides a data protection service to schools in the county.
6. Whether the Council uses any software to manage SARs or to redact documents for disclosure, and if so, the name of the product(s) and the contract end date.
Answer: The administration of SAR’s is managed through e-Case (contract end date 24 March 2028) and uses Objective Redact for redaction of documents (contract end date 10 April 2027).
7. Whether the Council has, in the same period, received any correspondence from the Information Commissioner's Office concerning its SAR compliance, and if so the number of such complaints.
Answer: Yes, one complaint was received.
If any part of this request would exceed the appropriate cost limit, please provide the information for the remaining parts and advise which part is affected. I am content to receive the response by email.
Documents
This is Herefordshire Council's response to a freedom of information (FOI) or environmental information regulations (EIR) request.
You can browse our other responses or make a new FOI request.