Artificial Intelligence and the Future of Subject Access Request: Transforming Data Disclosure Under the Uk GDPR
Abstract
This article critically examines the transformative impact of Artificial Intelligence (AI) on the administration of Subject Access Requests under the United Kingdom General Data Protection Regulation (UK GDPR). As organisations contend with exponential growth in electronically stored information, traditional manual disclosure practices have become increasingly unsustainable. Through doctrinal legal analysis, comparative regulatory research and documentary review, this study evaluates how AI technologies including Large Language Models, Natural Language Processing and semantic search are reshaping SAR administration while assessing the adequacy of existing legal frameworks. The research demonstrates that current UK data protection legislation remains sufficiently adaptable to regulate AI-assisted disclosure through its principles-based approach, though meaningful human oversight remains legally indispensable for interpreting statutory exemptions and balancing competing rights. The study identifies explainability as a defining governance challenge and proposes an original AI-Augmented Disclosure Governance Framework integrating legal obligations, organisational governance and AI-enabled technologies into a structured eight-stage model. The framework positions AI as an augmentation of professional legal judgement rather than a replacement, ensuring accountability under Article 5(2) UK GDPR. The article contributes to emerging scholarship at the intersection of AI, information governance and data protection law while offering practical recommendations for policymakers, regulators and organisations seeking to deploy AI responsibly within SAR processes. It concludes that AI should serve as an instrument for strengthening data protection principles through improved transparency, consistency and procedural fairness.
Keywords
Artificial IntelligenceData ProtectionDisclosure GovernanceRegulatory Governance TheorySubject Access Requests
References
Alon, U., Kamfonas, M. and Gonen, H. (2024) How Large Language Models Reason. arXiv preprint. Alston, P. (2022). Digital governance and human rights. Oxford University Press. Armstrong, J., & Ford, S. (2023). AI-assisted disclosure in data protection compliance. Journal of Data Protection Law, 15(2), 112–134. Article 29 Working Party (2017) Guidelines on Automated Individual Decision-Making and Profiling for the Purposes of Regulation (EU) 2016/679. Brussels: European Commission. Ashley, K. D. (2017). Artificial intelligence and legal analytics: New tools for law practice in the digital age. Cambridge University Press. Ashley, K. D. (2017). Artificial intelligence and legal analytics: New tools for law practice in the digital age. Cambridge University Press. Ayres, I., & Braithwaite, J. (1992). Responsive regulation: Transcending the deregulation debate. Oxford University Press. Barocas, S., Hardt, M., & Narayanan, A. (2019). Fairness and machine learning. MIT Press. Bennett, C. J., & Raab, C. D. (2021). The governance of privacy: Policy instruments in global perspective (2nd ed.). MIT Press. Bennett, C.J. (2018) The Governance of Privacy: Policy Instruments in Global Perspective. 2nd edn. Cambridge, MA: MIT Press. Binns, R. (2020). On the apparent conflict between individual and group fairness. Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency, 514–524. Black, J. (2008) ‘Constructing and Contesting Legitimacy and Accountability in Polycentric Regulatory Regimes’, Regulation & Governance, 2(2), pp. 137–164. Black, J. (2008). Constructing and contesting legitimacy and accountability in polycentric regulatory regimes. Regulation & Governance, 2(2), 137-164. Bommasani, R. et al. (2021) On the Opportunities and Risks of Foundation Models. Stanford University, Center for Research on Foundation Models. Bowen, G.A. (2009) ‘Document Analysis as a Qualitative Research Method’, Qualitative Research Journal, 9(2), pp. 27–40. Buchanan, J. (2024). Automation and accountability in data subject access. International Data Privacy Law, 14(1), 45–62. Bygrave, L.A. (2022) Data Privacy Law: An International Perspective. Oxford: Oxford University Press. Cabrera, M., & Walker, T. (2022). E-disclosure and AI in financial services regulation. Journal of Financial Regulation, 8(3), 201–225. Carey, P. (2024) Data Protection: A Practical Guide to UK and EU Law. 7th edn. Oxford: Oxford University Press. Council of Europe (1981) Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108). Creswell, J.W. and Creswell, J.D. (2023) Research Design: Qualitative, Quantitative and Mixed Methods Approaches. 6th edn. Thousand Oaks, CA: Sage. Crootof, R. (2021). Cyborg justice. Washington University Law Review, 98(5), 1245–1310. Dale, R. (2021). Natural language processing in legal technology. Natural Language Engineering, 27(4), 509–524. Data Protection Act 2018, c. 12. Data Protection Act 2018, c. 12. (2018). https://www.legislation.gov.uk/ukpga/2018/12/contents Data Protection Act 2018, c. 12. https://www.legislation.gov.uk/ukpga/2018/12/contents Dawson-Damer v Taylor Wessing LLP [2017] EWCA Civ 74. Department for Science, Innovation and Technology (2023) A Pro-Innovation Approach to AI Regulation. London: HMSO. Department for Science, Innovation and Technology (2024) Responsible AI in the UK. London: HMSO. Durant v Financial Services Authority [2003] EWCA Civ 1746. Edwards, L., & Veale, M. (2021). Accountability and data protection in AI systems. European Data Protection Law Review, 7(2), 191–205. European Commission (2020) White Paper on Artificial Intelligence: A European Approach to Excellence and Trust. Brussels. European Commission (2024) Regulation (EU) 2024/1689 Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act). Brussels. European Commission. (2021). Proposal for a regulation laying down harmonised rules on artificial intelligence. European Union. European Data Protection Board (2020) Guidelines 4/2019 on Article 25 Data Protection by Design and by Default. European Data Protection Board (2022) Guidelines on Data Subject Rights – Right of Access. European Parliament. (2024). Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (AI Act). Official Journal of the European Union. European Union (2016) Regulation (EU) 2016/679 (General Data Protection Regulation). European Union. (2024). Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union. Floridi, L. (2014) The Fourth Revolution: How the Infosphere is Reshaping Human Reality. Oxford: Oxford University Press. Floridi, L. (2023) The Ethics of Artificial Intelligence. Oxford: Oxford University Press. Goodfellow, I., Bengio, Y. and Courville, A. (2016) Deep Learning. Cambridge, MA: MIT Press. Grossman, M.R. and Cormack, G.V. (2011) ‘Technology-Assisted Review in E-Discovery Can Be More Effective and More Efficient than Exhaustive Manual Review’, Richmond Journal of Law and Technology, 17(3), pp. 1–48. Harrington, S. (2023). Healthcare data access and AI: Navigating UK GDPR compliance. Medical Law Review, 31(4), 589–612. Hildebrandt, M. (2020) Law for Computer Scientists and Other Folk. Oxford: Oxford University Press. House of Commons Science, Innovation and Technology Committee (2023) The Governance of Artificial Intelligence. London: HMSO. Hutchinson, T. and Duncan, N. (2012) ‘Defining and Describing What We Do: Doctrinal Legal Research’, Deakin Law Review, 17(1), pp. 83–119. Information Commissioner’s Office (2019) Explaining Decisions Made with Artificial Intelligence. Wilmslow: ICO. Information Commissioner’s Office (2020) AI Auditing Framework. Wilmslow: ICO. Information Commissioner’s Office (2021) Guidance on AI and Data Protection. Wilmslow: ICO. Information Commissioner’s Office (2023a) Guide to UK GDPR. Wilmslow: ICO. Information Commissioner’s Office (2023b) Right of Access Guidance. Wilmslow: ICO. Information Commissioner’s Office (2023c) Subject Access Requests Guidance. Wilmslow: ICO. Information Commissioner’s Office (2024) Data Protection Impact Assessments Guidance. Wilmslow: ICO. Information Commissioner's Office. (2020). Explaining decisions made with AI. ICO Guidance. Information Commissioner's Office. (2020). Guidance on the AI auditing framework. https://ico.org.uk/media/for-organisations/guide-to-data-protection/key- data-protection-themes/guidance-on-the-ai-auditing-framework-2-1.pdf Information Commissioner's Office. (2020). Guidance on the AI auditing framework. Retrieved from https://ico.org.uk Information Commissioner's Office. (2021). Accountability and governance framework for data protection. ICO. Information Commissioner's Office. (2022). Right of access guidance. https://ico.org.uk/for- organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/ Information Commissioner's Office. (2023). Subject Access Requests: Guidance for organisations. ICO. International Organization for Standardization (2023) ISO/IEC 42001:2023 Artificial Intelligence Management Systems. Geneva: ISO. International Organization for Standardization (2024) ISO/IEC 23894: Artificial Intelligence – Risk Management. Geneva: ISO. Ittihadieh v 5–11 Cheyne Gardens RTM Co Ltd [2017] EWCA Civ 121. Katsh, E., & Rabinovich-Einy, O. (2021). Digital justice: Technology and the internet of disputes. Oxford University Press. Kuner, C. (2020) Transborder Data Flows and Data Privacy Law. Oxford: Oxford University Press. Lees v Lloyds Bank plc [2022] EWHC 2249 (Ch). Mayer-Schönberger, V. and Cukier, K. (2013) Big Data: A Revolution That Will Transform How We Live, Work and Think. London: John Murray. McGregor, L., Murray, D. and Ng, V. (2019) ‘International Human Rights Law as a Framework for Algorithmic Accountability’, International & Comparative Law Quarterly, 68(2), pp. 309–343. Millard, C. (2022). Cloud computing and data protection: Challenges for SARs. Computer Law & Security Review, 45, 105–122. Mittelstadt, B., Wachter, S., & Russell, C. (2023). The ethics of AI-assisted legal decision- making. AI & Society, 38(2), 521–538. Mittelstadt, B.D. et al. (2016) ‘The Ethics of Algorithms’, Big Data & Society, 3(2). Mudassir, N. (2025) The Impact of Artificial Intelligence (AI) In Crime Detection and Prevention in Nigeria. African Journal of Modern Society. ISSN: 2141-3878, Ppg. 1- 16. National Institute of Standards and Technology (2023) Artificial Intelligence Risk Management Framework (AI RMF 1.0). Gaithersburg, MD: NIST. National Institute of Standards and Technology. (2023). Artificial intelligence risk management framework (AI RMF 1.0). NIST. OECD. (2019). Recommendation of the Council on Artificial Intelligence. OECD Publishing. Organisation for Economic Co-operation and Development (2019) OECD Principles on Artificial Intelligence. Paris: OECD. Organisation for Economic Co-operation and Development (2023) OECD AI Policy Observatory. Paris: OECD. Pasquale, F., & Cashwell, J. (2022). AI and the rule of law: Augmentation not replacement. Harvard Journal of Law & Technology, 35(1), 101–148. Pearce, F. (2022) Artificial Intelligence and Data Protection Law. London: Sweet & Maxwell. Purtova, N. (2018) ‘The Law of Everything: Broad Concept of Personal Data and Future of EU Data Protection Law’, Law, Innovation and Technology, 10(1), pp. 40–81. Russell, S. and Norvig, P. (2021) Artificial Intelligence: A Modern Approach. 4th edn. Harlow: Pearson. Russell, S., & Norvig, P. (2021). Artificial intelligence: A modern approach (4th ed.). Pearson. Sartor, G. and Lagioia, F. (2020) ‘The Impact of the General Data Protection Regulation on Artificial Intelligence’, European Journal of Risk Regulation, 11(4), pp. 717–746. Scherer, M. U. (2023). Regulating AI in data protection contexts. Columbia Law Review, 123(4), 1127–1180. Selbst, A.D. et al. (2019) ‘Fairness and Abstraction in Sociotechnical Systems’, Proceedings of FAT 2019, pp. 59–68. Solove, D.J. and Schwartz, P.M. (2024) Information Privacy Law. 8th edn. New York: Aspen. Surden, H. (2019). Artificial intelligence and law: An overview. Georgia State University Law Review, 35(4), 1301–1337. Susskind, R. (2019) Online Courts and the Future of Justice. Oxford: Oxford University Press. Susskind, R. (2022). Tomorrow's lawyers: An introduction to your future (3rd ed.). Oxford University Press. Susskind, R. (2023) How to Think About AI. Oxford: Oxford University Press. The Alan Turing Institute (2021) Understanding Artificial Intelligence Ethics and Safety. London. UK General Data Protection Regulation (UK GDPR). (2018). https://www.legislation.gov.uk/eur/2016/679/contents UK General Data Protection Regulation. (2018). https://www.legislation.gov.uk/eur/2016/679 United Kingdom (2018a) Data Protection Act 2018. London: HMSO. United Kingdom (2018b) European Union (Withdrawal) Act 2018. London: HMSO. United Kingdom (2019) Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019. London: HMSO. United Kingdom (2021) National AI Strategy. London: HMSO. United Kingdom (2023) AI Regulation White Paper. London: HMSO. United Kingdom (2025) Data (Use and Access) Act 2025. London: HMSO. United Kingdom Government (2023) Generative AI Framework for HM Government. London: HMSO. United Kingdom Government (2024) Algorithmic Transparency Recording Standard. London: HMSO. United Kingdom Parliament (2023) House of Lords Communications and Digital Committee: Large Language Models and Generative AI. London: HMSO. United Kingdom Parliament (2024) Artificial Intelligence (Regulation) Bill [HL]. London: HMSO. United Kingdom Parliament (2025) Data (Use and Access) Act Explanatory Notes. London: HMSO. United Nations Educational, Scientific and Cultural Organization (2021) Recommendation on the Ethics of Artificial Intelligence. Paris: UNESCO. Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, Ł., & Polosukhin, I. (2017). Attention is all you need. Advances in Neural Information Processing Systems, 30, 5998–6008. Veale, M. and Edwards, L. (2018) ‘Clarity, Surprises and Further Questions in the Article 29 Working Party Draft Guidance on Automated Decision-Making and Profiling’, Computer Law & Security Review, 34(2), pp. 398–404. Veale, M., & Zuiderveen Borgesius, F. J. (2021). Demystifying the draft EU AI Act. Computer Law Review International, 22(4), 97–112. Veale, M., Van Kleek, M. and Binns, R. (2018) ‘Fairness and Accountability Design Needs for Algorithmic Support in High-Stakes Public Sector Decision-Making’, Proceedings of CHI 2018. Wachter, S., Mittelstadt, B. and Floridi, L. (2017) ‘Why a Right to Explanation of Automated Decision-Making Does Not Exist in the General Data Protection Regulation’, International Data Privacy Law, 7(2), pp. 76–99. Wachter, S., Mittelstadt, B. and Russell, C. (2021) ‘Bias Preservation in Machine Learning’, Nature Machine Intelligence, 3(3), pp. 1–8. Wachter, S., Mittelstadt, B., & Russell, C. (2024). Hallucinations and accountability in LLMs. Nature Machine Intelligence, 6(1), 34–45. West, S.M., Whittaker, M. and Crawford, K. (2019) Discriminating Systems: Gender, Race and Power in AI. AI Now Institute. Wolford, K. (2020). Understanding the GDPR: A practical guide. Privacy International. Yeung, K. (2023). Algorithmic regulation and governance. Oxford Journal of Legal Studies, 43(1), 88–115. Zarsky, T. (2016) Incompatible: The GDPR in the Age of Big Data. Oxford: Oxford University Press. Zhou, J., Liu, Y., & Chen, X. (2023). Large language models for legal document processing. IEEE Transactions on Knowledge and Data Engineering, 35(8), 7890– 7905. Zuboff, S. (2019) The Age of Surveillance Capitalism. London: Profile Books.
More Articles from WORLD JOURNAL OF INNOVATION AND MODERN TECHNOLOGY
Influence of Artificial Intelligence Tools on Teachers’ Instructional Delivery in Public Senior Secondary Schools in Gokana and Khana Local Government Areas of Rivers State, Nigeria
Author: BIIBALOO Juliet Legborsi, EDO Barineka Lucky, PhD NWILE Charles Befii, PhD.
Community-Centered Digital Skills: Empowering Adults for Life- Long-Learning in Yola North Local Government Area
Author: Adamu Abdullahi Potiskum, Emeka Godwin Timothy, Lawan Ladan
Dielectric Performance of Natural Ester Insulating Fluids as a Sustainable Alternative to Mineral Transformer Oil: A Systematic Review
Author: Ude Kingsley Okechukwu, Ugwu Kelvin Ikechukwu, Mmamel Ngozi Juliana, Nnamani, Micheal Obiora
Artificial Intelligence and Inclusive Practices in Special Needs Education: Opportunities, Challenges, and Future Directions
Author: Rahima Ahmadu Ribadu, Bobboi Abubakar
Exploring the Relevance of Chatgpt in Student-Teacher Education: A Case Study of Federal College of Education, Yola
Author: Abubakar Mohammed Buba, Yahya Ahmed, .