AI-Generated Subject Access Requests: Can You Refuse Them?

Our clients are receiving more and more subject access requests that have plainly been written with AI: long, repetitive, and padded with legal argument, accusations and demands that have nothing to do with the right of access. A recent Employment Appeal Tribunal judgment prompted an obvious question. If a tribunal can push back on a 300-page ChatGPT skeleton argument, can a controller push back on a 30-page ChatGPT subject access request? The decision does not give you a new ground for refusal. However, it does sharpen the grounds you already have.

What the tribunal decided

In Hancox v Sutherland and Others, handed down on 17 September 2026, an unrepresented appellant filed a skeleton argument created using ChatGPT. It ran to 300 pages and almost 132,000 words, against an expectation of five to fifteen pages. He had not checked it, and invited the other side to identify any errors by four o’clock the next day. The judge said that submitting unchecked AI output and placing the burden of checking it on your opponent was not acceptable. The appellant withdrew reliance on the document, and the tribunal warned that similar documents would in future be likely to be rejected.

The important point is why. The problem was not that ChatGPT wrote it, but that the document was unmanageable, unchecked, unfocused and non-compliant. The tribunal was explicit that AI use is not prohibited. Handing over its output without taking responsibility for it is.

Why the analogy helps, and where it stops

What carries over

Several of the tribunal’s propositions transfer naturally. The requester remains responsible for defining what they are asking for, and cannot hand the job of interpreting a mass of generated text to the controller. Volume can obscure a request rather than clarify it. Repetition and duplication are legitimately relevant to whether a request is excessive. And the right of access is a right to personal data and prescribed supplementary information, not to answers, explanations or legal analysis. A controller is not obliged to respond to every AI-generated question or accusation that sits in the same document as a valid request.

Where it stops

A skeleton argument is governed by procedural rules, page limits and a tribunal’s case management powers. A subject access request is a statutory right. There is no rule that a request may be refused because it is long, complex or written by a machine. Refusing one as manifestly unfounded or excessive under Article 12(5) remains a high bar. The ICO’s guidance is that each request is dealt with on its own merits, that any refusal needs clear evidence behind it, and that a request which looks like a genuine attempt to exercise the right is unlikely to be manifestly unfounded. Hancox is a supporting analogy. It is not a legal basis.

A safer approach

Separate the request from the noise

Identify the valid subject access component: the personal data and Article 15 supplementary information actually sought. Then separate everything else, which in an AI-drafted request often means questions seeking opinions, legal arguments, demands for explanations, and general disclosure. You respond to the first. You explain, briefly, why the second is outside the right of access.

Use the tools the DUAA gave you

Three provisions matter here, two of them written into the UK GDPR by the DUAA. Article 15(1A) limits what you must provide to the product of a reasonable and proportionate search, so a generated list of fifty search terms does not create fifty obligations. Article 12A lets you stop the clock where you reasonably need clarification to identify the information requested. And the two-month extension for complex requests is still available. One caution: the requester can decline to narrow the request, and if they do, you still owe them a reasonable and proportionate search.

Document why

Whatever you decide needs to survive an ICO complaint. Record what was asked, what you treated as in scope, what you searched and why that was proportionate, and what you declined and on what basis. The common mistakes we see almost all come down to decisions that were reasonable at the time and undocumented afterwards.

When refusal becomes defensible

The case strengthens where the request contains extensive duplicated demands, repeatedly asks for information already supplied, lists people, systems and dates with no apparent connection to the requester, would impose a plainly disproportionate burden simply to interpret, forms part of a documented pattern pointing to an improper purpose, or requires you to investigate allegations rather than provide data. Even then, partial compliance is usually safer than refusal. Answer the intelligible Article 15 elements and explain in writing why the rest has not been actioned.

How Griffin House Consultancy Can Help

AI-drafted requests are a new shape of an old problem: working out what is actually being asked, and showing your working. We help triage complex requests, design a subject access process that holds up under scrutiny, and run the process day to day through our external DPO service. And if you have a compliance or HR team who manage subject access requests, we have a bespoke one day workshop just for them. Get in touch with us at Griffin House Consultancy, or call us on 01673 885533.

Author: Mike Martin LLM

Mike is an information rights law specialist and one of the founding Directors of the Griffin House Consultancy, a leading specialist data protection and information governance consultancy firm that supports hundreds of clients annually with their training, consulting and auditing requirements.