UK Housebuilders Increasingly Threatened with Costly DSARs

UK housebuilders are dealing with a spike in Data Subject Access Requests (DSARs) as homeowners leverage the process to move repairs, snagging and landscaping works to the front of the queue, Irwin Mitchell warns.

DSARs are a lawful request for an individual’s personal data held by an organisation. Crucially, it’s easy for a homeowner to initiate, often just a quick email and responses are generally due within one month and typically require significant administrative resource.

They are widely used across many sectors, and according to lawyers at Irwin Mitchell, DSARs have become increasingly common negotiating tactic in the housebuilding sector over the last year. If housebuilders are not prepared, it can be quicker and easier to remedy a defect, whether the housebuilder is liable or not, than to deal with the DSAR.

Matters have become more difficult with the widespread use of AI to write the requests. Often AI will include requests for information that the individual is not entitled to resulting in housebuilders not only having to deal with the request itself but also must manage the request and the unrealistic expectations of people about what they are entitled to.

The national law firm is calling on housebuilders to ensure they understand the DSAR process and have procedures in place to deal with it.

Irwin Mitchell says the first step is deciding whether DSAR requires a response. A request can be refused if it is “manifestly unfounded”, for example, when it is clearly intended to gain leverage in a dispute or made maliciously. This however is a high bar, and motives are rarely stated, making it difficult to evidence.

If a request does not meet that threshold, businesses must respond compliantly while minimising disruption. Clear procedures and expert support are essential.

Recent legal updates, including the Data (Use and Access) Act 2025, confirm that organisations need only carry out a reasonable and proportionate search, and can ‘stop the clock’ while seeking clarification on scope in certain circumstances.

Robert Tunningley, Construction partner at Irwin Mitchell, said:

“The use of DSARs is a real issue for the construction sector. Many homeowners aren’t interested in the data itself, and they know that the threat of a very broad DSAR can be a powerful lever to get their alleged defect fixed sooner. It’s vital that developers have a clear strategy around this issue, backed by specialist advice and rehearsed procedures, in order to avoid being exposed.

“From a policy consideration perspective, it is arguable that using DSARs in this manner is an abuse of process, and potentially vexatious which is perhaps a point for Judges and the legislators. Misuse in this way was never the purpose of the legislation, and perhaps there ought to be greater scrutiny on such use”.

Joanne Bone, Commercial partner at Irwin Mitchell and data protection specialist, added:

“Even a straightforward data subject access request can be resource intensive. The number of IT systems within businesses that store personal data and the multiple communication methods, including informal methods such as WhatsApp, mean that the volume of personal data is much higher than it used to be.  This is compounded by having to manage the scope of requests made by AI. Every organisation should ensure it is properly set up to respond within the timescales lawfully and efficiently.”