What not to do when your organisation receives a Subject Access Request
In November 2025 the Court of Appeal handed down judgment in the case of Nadine Buzzard-Quashie v Chief Constable of Northamptonshire Police [2025] EWCA Civ 1397. The case highlighted the importance of compliance when handling a Subject Access Request (SAR), illustrating that persistent non-compliance can lead to serious repercussions.
Background and the SAR
In September 2021, Ms Buzzard-Quashie, made a SAR to Northamptonshire Police (Police Force) following an alleged wrongful arrest. Ms Buzzard-Quashie alleged that during the arrest she was assaulted, and her property was unlawfully seized and never returned. She therefore made a SAR to obtain the video footage of her arrest, which was recorded on the officers’ body-worn cameras.
The Police Force refused the SAR and Ms Buzzard-Quashie made a data protection complaint to the Information Commissioner’s Office (ICO).
The ICO’s decision favoured Ms Buzzard-Quashie and ordered the Police Force to revisit its handling of the SAR and provide Ms Buzzard-Quashie with ‘a comprehensive disclosure of the personal data to which [she] would be entitled as soon as possible’. However, despite the ICO’s decision, the Police Force only provided Ms Buzzard-Quashie with isolated clips of her arrest, which did not contain conversations she remembered having with the arresting officers.
Proceedings in the County Court
Ms Buzzard-Quashie issued proceedings in Brentford County Court against the Chief Constable of the Police Force and sought an order from the court ordering the Police Force to provide her with all missing footage.
At a hearing on 25 April 2023, over a year and a half after the SAR was made, the judge made an order (Brentford Order) for the Police Force to ‘provide [within 28 days] all and any footage taken on police cameras relevant to the arrest and detention of the claimant’. He also ordered that if no video evidence was available or disclosable, ‘a statement from an officer of a rank no lower than Inspector must accompany the disclosure stating why such video footage is no longer available or disclosable’.
However, the Police Force failed to comply with any element of the Brentford Order. As a result, Ms Buzzard-Quashie made an application for contempt against the Chief Constable of the Police Force. The application was heard in Central London County Court, and whilst the judgment confirmed that the police had not complied with the Brentford Order, the judge declined to find the Chief Constable in contempt of court.
The appeal
Ms Buzzard-Quashie appealed on the ground that the judge had made an error of law when she ruled that the conduct leading to the breach had to be ‘wilful, deliberate or contumelious’ to constitute contempt.
The Chief Constable initially resisted the appeal. However, a week before the appeal hearing, the Chief Constable conducted a data audit, which revealed further footage which should have been disclosed pursuant to the Brentford Order. This meant that numerous statements made on the Chief Constable’s behalf to the County Court and Court of Appeal were false and untrue.
It transpired that when the Police Force initially conducted a search for the body-worn camera footage, they did not use the names of the arresting officers but instead used an ‘occurrence number’, which was in fact incorrect.
The day before the Court of Appeal hearing, the Chief Constable conceded that there was a breach of the Brentford Order and admitted that he was in contempt of court. He was subsequently fined a total of £50,000.
What lessons can organisations learn from this case?
1. Take SARs seriously and respond to them properly in a timely manner
The Police Force failed to take Ms Buzzard-Quashie’s request seriously, shown by their refusal of her initial SAR, the fact that even after involvement from the ICO they did not produce all the footage, and their clear disregard for the subsequent court orders. According to the court judgment, the explanation given by the Police Force for not providing additional footage was either that there was no such footage, or that what additional footage existed had been destroyed. Had the Police Force provided Ms Buzzard-Quashie with the requested footage or an explanation as to why they were legitimately withholding it, they could have avoided the expense and public scrutiny that comes with litigation.
Organisations should therefore ensure they respond to SARs adequately, in accordance with statutory timelines, and only withhold information that is exempted under the Data Protection Act 2018 (DPA).
2. Ensure your company conducts robust and thorough searches for relevant data
The court criticised the Police Force’s approach to conducting searches for information, in particular the fact that they only searched using a reference number. Had the Police Force conducted a thorough search using the arresting officer’s names, the additional information would have been found earlier.
Organisations need to ensure that they are using appropriate search terms and identifiers when looking for relevant data, and more importantly, that they are inputted correctly! This could be done by searching using not only reference numbers but using a variety of key terms (including a variation of spellings), as human errors do happen!
3. Monitor and comply with regulatory directions and legal orders
The Police Force failed to carry out thorough searches for footage following the ICO’s decision and failed to comply with the terms of the Brentford Order, which ultimately led to the Chief Constable being found in contempt of court.
If your organisation receives a report from the ICO on how you have handled a SAR, and the report identifies non-compliance and provides directions on how to rectify the issues, it is important that you address the issues as soon as possible. If you have any questions regarding the decision, it is important to communicate this with the ICO or obtain independent legal advice on how you should proceed.
4. Be transparent and truthful in your communications
The Chief Constable acknowledged that false and misleading statements concerning the existence or whereabouts of the footage were made by him and on his behalf.
It is important that organisations clearly set out in their response to the data subject why they are refusing or withholding information. If you know that information exists but don’t think it should be provided to the data subject, then it is crucial that you seek legal advice on whether you can rely on an exemption. It is a criminal offence for organisations to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure under Section 173 of the DPA 2018.
5. Senior leadership is accountable for systemic compliance
Here, it was not the Chief Constable who provided the initial responses to the SAR; however, when it came to it in court, it was held that he was responsible for the Police Force’s actions in handling it.
In a similar case from September 2025, the director of a care home was criminally prosecuted under the DPA after failing to comply with a SAR. The ICO made it clear that when an organisation receives a SAR, directors, managers and employees all have a responsibility to ensure compliance. Further details of the case can be found here.
It is important that directors and senior management make sure that their organisation has sufficient and appropriate systems in place to deal with SARs.
6. Poor compliance can have serious consequences.
This landmark case shows that failing to comply with your obligations when responding to SARs can lead to drastic consequences, not only for an organisation but also for directors and senior management. Repeated failures can result in unnecessary and costly litigation, damage to an organisation's reputation, and even criminal convictions!
Ultimately, the case reinforces the point that if your organisation receives a SAR, make sure to conduct a thorough search using a range of appropriate (and correctly spelt) search terms. Doing this may save you the hassle of litigation further down the line. And if you are unsure on what to do, seek legal advice as soon as possible.
For support on any of the issues raised in this article, please contact Alex Craig using 0191 211 7911 or [email protected].