Searching email for subject access requests

Does a subject access request include emails?

Yes. Article 15 of the UK GDPR gives people the right to confirmation that their personal data is being processed, access to that data and supporting information. Personal data in email is covered like any other: messages they sent or received, messages about them between colleagues, and attachments that mention them.

The right is to the personal data, not to every email that mentions a name. Working out which parts of which messages to disclose, and what to withhold or redact to protect other people (Article 15(4) says the right to a copy must not adversely affect the rights and freedoms of others), is a judgement for whoever handles the request. This page is about the search, not about those decisions, and it is not legal advice. For the retention side, see email retention and UK GDPR.

How long you have to respond

The timescales are in Articles 12 and 12A of the UK GDPR, as amended by the Data (Use and Access) Act 2025:

These provisions came into force on 5 February 2026, and the text is on legislation.gov.uk. Article 12A(6) gives, as an example of when clarification may be reasonable, a controller that processes a large amount of information about the person, which is often the case with a long-serving employee's mail.

A reasonable and proportionate search

The Data (Use and Access) Act 2025 inserted Article 15(1A) into the UK GDPR, with effect treated as applying from 1 January 2024. It says a person is only entitled to the confirmation, personal data and information that the controller is able to provide "based on a reasonable and proportionate search".

That does not shrink the job to nothing. You still need a search you can explain: which mailboxes, which dates, which names and email addresses, and why. What it changes is the starting point, from finding every last reference to carrying out a sensible, defensible search.

An archive helps on both sides of that test. A complete, searchable copy of mail makes a thorough search reasonable to run, and saved searches and an audit log record what you did, which is the evidence you need if the search is challenged.

Why SAR searches are hard without an archive

Most organisations find the same problems the first time a former employee or an unhappy customer sends a request:

• Mail is spread across dozens of mailboxes, with no single place to search them all
• Users have deleted messages, so the live mailboxes are incomplete
• Leavers' accounts have been deleted, or their mail sits in a PST file on a shared drive
• IT staff end up running searches through mailboxes they should not be reading
• There is no record of what was searched, so the response is hard to defend

Native tools help within limits. Microsoft Purview eDiscovery can search live and inactive mailboxes in your tenant, and Google Vault can search licensed users' Gmail. Neither reaches mail that has already left the platform, and Google warns that deleting a user or a required licence can purge their data from Vault. See email eDiscovery for how the native tools compare.

Searching for a SAR in NinjaOne Archiver

With NinjaOne Archiver, journaling copies incoming and outgoing messages as they are sent and received, so the archive can hold mail that users later deleted and mail of people who have since left. A SAR search then looks like this:

1. A Data Protection Officer or Compliance and Review Officer opens Compliance > eDiscovery in the End-User Portal
2. They search across all relevant accounts for the requester's names, email addresses and other identifiers, in the From, To/CC/BCC and Keywords fields, combined with AND and OR
3. They set a date range that matches the request and your retention periods
4. They save the search, so it can be rerun and explained later, and tag the results
5. They flag results for review, and a Data Protection Officer or assigned Reviewers mark them as reviewed
6. A Compliance and Review Officer downloads the agreed results for redaction and response outside the archive (Data Protection Officers cannot download)

The compliance roles can keep this away from the IT team: NinjaOne says the IT Admin role cannot access the compliance features, although the Full Admin role can, so choose who holds Full Admin with care. That matters when the requester is a former colleague of the people who run your systems.

Retention cuts both ways

An archive does not mean keeping everything for ever. UK GDPR's storage limitation principle still applies, and mail kept past its retention period is mail you may have to search and disclose. Set retention policies by user, department or domain in line with your email retention policy, and use a legal hold only where a dispute is in prospect.

A sensible archive keeps what you need for as long as you need it, makes it searchable, and lets the rest expire on schedule. That is the balance a SAR exposes.

How Forever Systems helps

We can supply and set up NinjaOne Archiver for Microsoft 365 and Google Workspace, assign the compliance roles, and show your data protection lead how to build, save and tag a search for a request. We can also bring older mail and leavers' PST files into the archive so they are searchable in the same place.

We do not handle SARs, decide what to disclose or redact, or give legal advice. Contact us to talk about making email searches for subject access requests practical. For staff awareness, our sister site covers GDPR training for staff.