SAR – ‘An Ongoing Investigation’

2026 – ongoing with the ICO as at June 2026:

If a SAR is made, a constabulary may respond that the ‘investigation is ongoing’ and decline to disclose information.

Whilst less likely with a vehicle theft report as these are often quickly closed with little enquiry undertaken, should this be the response, a new SAR will need to be made, the process recommenced – currently (as at 06/2026) the ICO is supporting TVP’s stance that the original SAR ends when an ‘ongoing investigation’ exemption is cited and that the SAR process must be recommenced once the investigation is concluded.

We are challenging this position – as below.

The ICO advised, 05/2026, Case Reference IC-513402-Z3F0:

If a constabulary declines to disclose the information for a valid reason i.e. ‘the investigation is ongoing’, that SAR is effectively killed at this stage.
The data controller, the constabulary, would be considered to have complied with their obligations since a lawful response had been provided.
A new/fresh SAR would need to be submitted upon completion of the investigation in question. There is no provision within the legislation to compel the data controller to partially comply with a request during an ongoing investigation.
There is no way to avoid submitting a new SAR since the initial SAR, in the eyes of the legislation so to speak, the initial SAR has received a lawful response and is complete/closed

However, aspects of the conduct do not sit comfortably and therefore the ICO was asked as follows:

To the ICO

I ask the ICO to consider a narrow data-protection issue arising from Thames Valley Police’s handling of a Subject Access Request.

The issue is not whether police may restrict access to personal data while an investigation is ongoing. I understand that, in appropriate circumstances, law-enforcement restrictions may apply. The issue is what should happen where:

a valid SAR is submitted by or on behalf of the data subject;
the police refuse or restrict disclosure because the investigation is ongoing;
the investigation then concludes shortly afterwards;
the police accept, or indicate, that the original reason for restriction may no longer apply; but
the police state that the original SAR is closed and that the requester must submit a fresh SAR before the same material can be reassessed.
In the matter prompting this enquiry, Thames Valley Police’s complaint outcome records that a SAR was submitted on 14 January 2026, that a response dated 16 January 2026 applied an exemption because the investigation was ongoing, and that once the investigation later concluded the exemption might no longer be relevant. However, TVP’s position was that the requester had to submit a new SAR because the original SAR had been completed and closed.
I ask the ICO to consider whether that approach is lawful and consistent with data-protection rights in practice.
In particular:
where the only barrier to disclosure is said to be the ongoing status of an investigation, is a controller entitled to treat the SAR as finally closed and require a fresh SAR once that temporary barrier has ceased;
should the controller instead reassess disclosure under the original SAR, or treat later correspondence as a renewed or continuing request;
if a fresh request is required, does the one-month response period start only from that second request, even though the original request was valid and the data subject has been waiting throughout;
should the controller explain the statutory or policy basis for requiring a fresh SAR in those circumstances;
how should this interact with consent-based disclosure or third-party SAR routes where an authorised representative is acting for the data subject.

The wider concern is that requiring a fresh SAR after investigation closure may create avoidable delay. In vehicle theft claims, that delay can affect claim progression, financial hardship and the victim’s ability to resolve the matter.

I would be grateful for the ICO’s view on this narrow point.

13/05/2026 – from to ICO

Sent: 13 May 2026 17:46
Subject: ICO Case Reference: IC-513402-Z3F0

Thank you for your email regarding a Police services refusal of a subject access request.

In response to the questions asked I would confirm as follows;

Yes, the data controller is correct in considering the original request responded to when they provide the response that the request cannot/will not be complied with owing to an ongoing investigation.
No, a new an separate request would need to be submitted and considered separate from any previous right of access request.
As above, the new request upon completion of an investigation is considered a new and separate request so the statutory timeframe clock so to speak would start again.
No, the refusal of the original SAR due to an ongoing investigation is considered an appropriate response and so no further explanation or details is required under current legislation.
The requirement to resubmit a request should not impact authorised representative permissions to submit requests.

The right of access can be restricted in certain circumstances, among those being during an ongoing investigation as outlined within the Data Protection Act 2018 Part 3 s45(4)(a).

I hope this information is helpful to you. If you need advice on a new issue you can contact us via our Helpline on 0303 123 1113 or through our live chat service. In addition, more information about the Information Commissioner’s Office and the legislation we oversee is available on our website ico.org.uk.

To the ICO:

If I can clarify as this will be important to several matters:

if TVP (the police) receive a SAR and state ‘no disclosure will occur due to ongoing enquiries’ – this effectively kill/end that 1^st SAR and
it is necessary, for disclosure, to make a 2^nd, new request, once the enquiries are complete.

Is there the ability to challenge or argue:

that at the date of the 1^st SAR, information held should be disclosed with he ongoing enquiries redacted – effectively I am asking whether an enquiry relating to one aspect of an enquiry can impact the entire request

I am particularly struggling with this because the initial SAR could, to my mind, permit some information to be released. In this instance, and my area of activity is vehicle theft, the recovery of the vehicle and its examination by the police were the ‘ongoing enquiries’. The SAR did not require this information; we knew the vehicle was found, recovered, in storage and awaiting examination and subsequent report. That this too a month in this instance was troubling – you can imagine, the victim felt prejudiced because his vehicle had been found! He then had to start again with a SAR.

I am wondering whether, for example, his SAR and our TP SAR / consent approach could be tweaked to advise ‘provide the crime report, less reference to ongoing investigations’

You will appreciate I am simply trying to speed the process up for victims. Is there any means by which to avoid the need to re-issue a SAR – ‘ongoing investigations’ could cover a multitude!

29/05/2026 – from the ICO

Sent: 29 May 2026 11:56
Subject: Your email to the ICO – Case Reference IC-513402-Z3F0

Thank you for your email of 13 May 2026, please accept my apologies for the delay in coming back to you.

I would advise as follows;

A. Yes, the first SAR is effectively killed at this stage and the data controller would be considered to have complied with their obligations since a lawful response would have been provided.

B. Yes, a new / fresh SAR would need to be submitted upon completion of the investigation in question.

C. There is no provision within the legislation to compel the data controller to partially comply with a request during an ongoing investigation.

There is no way to avoid submitting a new SAR since the initial SAR, in the eyes of the legislation so to speak, the initial SAR has received a lawful response and is complete/closed.

04/06/2026 – to the ICO

Thank you for your response. I remain concerned that the position stated may be too broad and risks being misunderstood by controllers as permitting a blanket refusal of Part 3 SARs whenever an investigation is ongoing.

I accept that, where a controller has lawfully applied a Part 3 restriction and responded to a SAR, the controller may not be required to keep that SAR open indefinitely.

I also accept that a further request may be required once the temporary reason for restriction has ceased.

However, my concern is with the lawfulness of the original response and, in particular, whether the controller was entitled to refuse disclosure in full.

Section 45(4) DPA 2018 permits restriction “wholly or partly” only “to the extent that and for so long as” the restriction is necessary and proportionate, having regard to the data subject’s fundamental rights and legitimate interests.

The ICO’s own guidance states that a controller should only apply a restriction to the extent necessary and “must provide the person with any information that does not come within the restriction”. It also states that, where the purpose can reasonably be achieved by another means, for example redaction, that should be done instead.

My approach appears to fit the ICO’s guidance; I understood there would be some withholding (the outstanding enquiry pertaining to the vehicle examination upon recovery) and I appreciated, as is common, that some data may be redacted (TP information, for example).

In the circumstances, I respectfully ask the ICO to clarify its statement that there is “no provision within the legislation to compel the data controller to partially comply with a request during an ongoing investigation”. That appears difficult to reconcile with section 45(4) and the ICO’s published guidance.

The issue I ask the ICO to address is therefore not whether police may restrict access during a live investigation. They plainly may, where the statutory test is met.

The issue is whether they may refuse the entire SAR without demonstrating that partial disclosure, redaction, or disclosure of non-sensitive material would still obstruct or prejudice the investigation.

In a vehicle theft matter, for example, it may be legitimate to restrict aspects forensic examination details, suspect intelligence, witness information, CCTV, ANPR material (that has bene undertaken or is held against the vehicle, within the crime report). It may be legitimate to restrict live lines of enquiry – in this instance the police identified and disclosed this; a forensic vehicle examination was to occur. That does not necessarily explain why the controller could not disclose, or consider disclosing, basic crime report information (Day/Date/Time/Place – DDTP), chronology, recovery information, data already generally known to the victim, or other material not capable of prejudicing the investigation.

Please therefore confirm whether the ICO’s position is that:

an ongoing investigation may justify a restriction only where disclosure would create a real, non-speculative risk falling within section 45(4);
the controller must consider whether partial disclosure or redaction would avoid that risk;
the controller must provide personal data that does not fall within the restriction; and
the controller must record its reasons for any full or partial restriction and provide those reasons to the ICO if requested.

The police have treated the case as though “ongoing investigation” is a complete exemption, when the law requires a targeted, necessary and proportionate restriction.

I would be grateful if this could be treated as a request for clarification, because the present wording could otherwise encourage police forces to treat an ongoing investigation as an automatic basis to close SARs in full, requiring victims to start again later, even where some information could properly have been disclosed at the outset.

From the ICO
Sent: 16 June 2026 13:13
Subject: Your email to the ICO – Case Reference IC-513402-Z3F0

Thank you for your email of 4 June 2026.
I would advised that the ICO would not expect or ask the data controller to consider partial disclosure, redaction, or disclosure of non-sensitive material when a lawful exemption has been applied, as is the case in this instance. It is fundamentally not considered appropriate to disclose information during an ongoing investigation since it cannot reasonably be assumed what information will fall within the scope of any ongoing investigation.

While I appreciate your frustrations with this issue we do not consider that further action is required and that an appropriate exemption has been applied in this instance.

This case is now closed on our systems and I have now provided you with a final outcome to your complaint, I do not consider that further action is required at this time.

Your options

Please note that if you are dissatisfied with the way your case has been handled, you can ask to have it reviewed. For more information please refer to our website

Complain about us | ICO
Alternatively if you believe that the ICO has provided you with a poor service, or if you believe we have not treated you properly or fairly then you may be able to complain to: The Parliamentary and Health Service Ombudsman (PHSO), Millbank Tower, Millbank, London, SW1P 4QP.

All complaints to the PHSO must be made through an MP. If you require further information about the PHSO, you can call its helpline on 0345 015 4033.

26/06/2026 – to the ICO

Thank you for your email of 16 June 2026 which I have taken the time to review in some detail. As below, information noted directly counters the statement that the ICO would not expect partial disclosure/redaction/non-sensitive disclosure once an exemption has been applied

I am disappointed by the response and ask that this matter is reviewed under the ICO’s case review / service complaint process. I note, form our response, a review facility is available.

My concern is not merely that I disagree with the outcome.

My concern is that the reasoning provided appears inconsistent with the ICO’s own guidance on Part 3 DPA 2018 subject access requests and restrictions.

You state:

“the ICO would not expect or ask the data controller to consider partial disclosure, redaction, or disclosure of non-sensitive material when a lawful exemption has been applied…”

Respectfully, that appears to be too broad.

The ICO’s own guidance on the Part 3 right of access states that a restriction may be applied in full or in part only where it is necessary and proportionate. It also states that the controller should only apply a restriction to the extent necessary, and must provide the person with any information that does not come within the restriction.

The guidance further explains that, where possible, a controller should generally provide as much information as it can, for example by redacting sensitive data and providing the remaining information.

That is the issue I asked the ICO to consider.

This was not a request for the ICO to force disclosure during a live investigation regardless of risk. The issue was whether TVP had applied a blanket restriction simply because the investigation was live, without considering:

whether all material genuinely required restriction;
whether non-sensitive material could be disclosed;
whether any partial disclosure could be made;
whether redaction could protect any genuinely sensitive information;
whether the restriction was applied only to the extent necessary and proportionate;
whether the reason for restriction was recorded;
whether, once the temporary investigation-related basis fell away, TVP should have reassessed the position or treated further correspondence as a continuing or renewed request rather than requiring the victim to start again.

Your response states that it is “fundamentally not considered appropriate to disclose information during an ongoing investigation since it cannot reasonably be assumed what information will fall within the scope of any ongoing investigation.”

That appears to turn a necessary-and-proportionate assessment into a blanket rule.

The ICO’s guidance does not, as I understand it, say that all information can automatically be withheld simply because an investigation is ongoing. It says the restriction must be necessary and proportionate and must be applied only to the extent required.

The practical facts here matter.

The requester was the victim of a vehicle theft. The information sought was required to progress an insurance claim. The vehicle had been recovered. The issue was not an attempt by a suspect to frustrate an investigation. The practical delay appears to have arisen because:

the recovered vehicle required examination;
disclosure was delayed while the investigation remained open;
after the examination stage, the matter could not be finalised because the supervising sergeant was unavailable;
TVP then maintained that a fresh SAR was required, despite accepting that the original restriction may no longer apply.

I accept that the ICO may conclude that some information could properly be restricted while the investigation was live. However, the ICO’s final outcome does not appear to address whether TVP considered proportionality, partial disclosure, redaction, non-sensitive material, or the victim’s legitimate interests.

I also remain concerned that the same case officer has provided what is described as the final outcome, rather than the matter being escalated for review after I challenged the initial position.

Please clarify whether this email is itself the case review outcome, or whether it can now be reviewed by someone not previously involved in the handling of IC-513402-Z3F0.

For clarity, I ask the ICO to review:

whether the final outcome accurately reflects the ICO’s own Part 3 right-of-access guidance;
whether it was correct to state that the ICO would not expect a controller to consider partial disclosure, redaction, or disclosure of non-sensitive material once an exemption/restriction is applied;
whether TVP was asked to evidence the specific restriction relied upon and the reasons it was necessary and proportionate;
whether TVP recorded its reasons for restricting access;
whether TVP considered partial disclosure or redaction;
whether the ICO considered the fact that the requester was a victim of crime seeking information to progress an insurance claim;
whether the ICO considered the post-investigation position, namely whether TVP should have reassessed disclosure or treated subsequent correspondence as a continuing or renewed request once the temporary restriction ceased to apply.

I ask that this matter is reviewed by someone who has not previously handled the case.

Yours sincerely,

Philip Swift

SOURCES:

Can we restrict the right of access under Part 3? LINK

This appears key:

A controller cannot restrict access just because there are ongoing proceedings.
The controller must be able to demonstrate why restriction is necessary and proportionate.
The restriction should be applied only to the extent necessary.
Information not falling within the restriction should still be provided.

What is the right of access in Part 3 of the DPA 2018? LINK

Provides background on Part 3 DPA 2018 subject access rights and the restrictions available under section 45(4)

Part 3 right of access / law-enforcement processing. LINK

This also refers to restrictions being necessary and proportionate, including where third-party rights or law-enforcement purposes are engaged

What should we do if the Part 3 request involves information about other people? LINK

This explains, as I understand, the redaction / partial-disclosure point. It addresses how information about others should be handled rather than assuming everything must be withheld

Law enforcement processing: Part 3 DPA 2018 and data sharing. LINK

The point that Part 3 information can, in some circumstances, be shared or repurposed, and that the regime is not simply a prohibition on disclosure.

Site notes (restricted)