The Information Commissioner's Office (ICO) has issued an enforcement notice to Bristol City Council for failing to comply with its legal obligations to respond to subject access requests (SARs).
The notice is in response to more than 60 complaints made to the ICO over the backlogs since 2023.
It also comes just weeks after the First-tier Tribunal upheld an ICO decision to issue an enforcement notice against Bristol – this time over delayed responses to freedom of information requests.
The ICO had initially made informal enquiries with the council regarding its handling of SARs – which allow people to request the council provide any personal information that it holds relating to them – in February 2023.
In March 2023, Bristol told the ICO it had a backlog of 170 overdue SARs, with the oldest dating back to December 2020.
By February 2024, the backlog had increased to 189, leading the ICO to launch a formal investigation.
In its enforcement notice, the ICO noted that Bristol had attempted to resolve the backlog by engaging an external organisation to help process the oldest and most complex cases.
However, Bristol later complained about the external organisation's poor output, which saw the organisation complete just two SARs between July 2024 and March 2025.
As of June 2025, the backlog had grown to 231, with the oldest SAR still being over three years old. Bristol aimed to clear the backlog – most of which concerned requests relating to children's social care data – by the end of 2026.
In its enforcement notice, the ICO said: "Regardless of the difficulties with the external organisation, the Commissioner does not consider this to be an acceptable amount of time to clear the existing backlog."
It added: "BCC's approach towards compliance with its obligations under UK GDPR has been of significant concern and demonstrates a poor organisational attitude towards data subjects' rights and BCC's compliance with the law.
"For example, in response to a query from the Commissioner regarding SAR resourcing, BCC stated 'I would suggest it is for the ICO to advise if the council is adequately resourced'.
"Although the Commissioner understands the difficult impact under-resourcing has on organisations, this is not an issue for the Commissioner to rectify."
The ICO said it is of the view that organisations must demonstrate compliance with data protection obligations and judge what resources are appropriate for themselves "as they alone will best understand the pressures they face".
The ICO found that Bristol had infringed the following provisions of the UK GDPR:
- Article 15(1), as BCC has failed to provide data subjects with confirmation as to whether or not personal data concerning them is being processed, and has failed to provide access to the personal data and to the information as set out in Article 15(1)(a) to (h).
- Article 15(3), as BCC has failed to provide data subjects with a copy of the personal data undergoing processing.
- Article 12(3), as BCC has failed to provide information on action taken on a request under Article 15 to data subjects without undue delay, and in any event within one month of receipt of the request
Ahead of issuing the notice, the ICO considered representations from Bristol, which said an enforcement notice would be "premature" and argued for a collaborative approach to managing the backlog.
Bristol also said it had made tangible progress with the cases from 2022 and progress on its 2023 cases, with 11 cases having been closed.
However, the ICO said that it had been engaging with Bristol since March 2023, "and limited progress has been made" over the period.
The enforcement notice requires Bristol to clear its SAR backlog in a timely manner, inform people with overdue requests of the delays and make improvements to its handling of requests.
Sally-Anne Poole, Head of Investigations at the ICO, said: "Despite our repeated engagement with Bristol City Council over a sustained period of time, limited progress has been made to clear a backlog of requests.
"Our investigation has found that the Council's approach towards compliance demonstrates a poor organisational attitude towards data rights and compliance with the law."
Bristol is entitled to appeal against this Enforcement Notice to the First-tier Tribunal (Information Rights) under Section 162(1)(c) DPA 2018.
Cllr Tony Dyer, leader of Bristol City Council, and Chair of the Strategy and Resources policy committee, said: “Officers have been in close contact with the Information Commissioner’s Office during the review of the council’s performance in responding to Subject Access Requests.
"During this process we have put in place new structures to ensure information requests are acknowledged and responded to in a more timely fashion, this includes hiring more people to administer this function and deliver responses within statutory time limits."
He added: "Additional actions are already underway to notify all people with overdue requests, clear the backlog and deliver further improvements to our systems and procedures. These actions are being taken at a time when the volume of requests has more than doubled in recent years."
Adam Carey
