DSARs in Regulated Industries: Finance, Healthcare, and Legal Compliance

When Privacy Law Meets Sector Regulation

Processing a DSAR is straightforward in theory: receive the request, find the data, provide it. But in regulated industries — financial services, healthcare, and legal professions — the straightforward becomes complicated. These sectors operate under their own regulatory frameworks that create additional obligations, exemptions, and conflicts when layered on top of data protection law.

A financial services firm cannot just hand over every piece of data it holds — some information is subject to regulatory retention requirements or anti-money laundering rules. A hospital must navigate the intersection between patient access rights and data protection rights. A law firm must protect legal professional privilege while still complying with subject access requests.

This guide covers how DSARs work in each of these sectors, the key exemptions and complications, and how to build a sector-aware workflow.

Financial Services

The Regulatory Landscape

Financial services firms operate under a dense web of regulation. In the UK, the Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) impose conduct and prudential requirements. In the EU, MiFID II, PSD2, and the Anti-Money Laundering Directives add further layers. In the US, SEC, FINRA, CFPB, and state regulators each have their own requirements.

These sector regulations do not override data protection rights, but they do create specific complications when processing DSARs.

Common DSAR Complications in Finance

Regulatory retention requirements. Financial services firms must retain certain records for prescribed periods. MiFID II requires retention of transaction records, communications, and order records for at least five years (and up to seven in some cases). Anti-money laundering regulations typically require retention of customer due diligence records and transaction data for five years after the end of the business relationship.

When a customer requests erasure under GDPR Article 17, these retention obligations constitute a legal basis for continued processing under Article 17(3)(b) — compliance with a legal obligation. You can refuse erasure for data subject to mandatory retention, but you must still comply with access requests for that same data.

Anti-money laundering (AML) tipping off. Under the Proceeds of Crime Act 2002 (UK) and equivalent AML legislation elsewhere, it is a criminal offense to tip off a person that a suspicious activity report (SAR — confusingly, the same acronym) has been filed about them. If a customer submits a DSAR and your records include notes about suspicious activity reports or ongoing investigations, disclosing this information could constitute tipping off.

The DPA 2018 Schedule 2, Part 1, Paragraph 2 provides an exemption for data processed for the prevention or detection of crime. You can rely on this exemption to withhold information where disclosure would prejudice a criminal investigation or constitute tipping off. Document your reasoning carefully.

Payment services data. Under PSD2, payment service providers must provide customers with specific information about their transactions. This right exists independently of GDPR Article 15. A DSAR response from a payment services firm should address both the data protection access right and any PSD2 information obligations.

Complaint records. FCA-regulated firms must retain records of complaints and their handling. These records often contain personal data about the complainant and may include notes from staff involved in resolving the complaint. When processing a DSAR, complaint records must be searched and disclosed, subject to third-party data redaction.

Financial Services DSAR Workflow Additions

When processing DSARs in financial services, add these steps to your standard DSAR workflow:

1. Check for AML flags. Before compiling the response, check whether the individual has any active suspicious activity reports or is the subject of an ongoing investigation. If so, consult your Money Laundering Reporting Officer (MLRO) before disclosing any related records.
2. Identify regulatory retention data. Flag any data subject to mandatory retention periods that cannot be deleted even if the individual requests erasure.
3. Review for market-sensitive information. In investment firms, ensure that disclosure of trading data or investment advice records does not inadvertently reveal proprietary strategies or breach market abuse regulations.
4. Coordinate with compliance. The compliance function should review DSAR responses before they are sent, particularly where exemptions are being applied.

Healthcare

Patient Access vs Data Protection Access

Healthcare creates a unique DSAR challenge because two separate access frameworks overlap: the patient's right to access their medical records under healthcare-specific legislation, and the data subject's right of access under data protection law.

In the UK: The Access to Health Records Act 1990 governs access to paper-based health records of deceased persons. For living individuals, the UK GDPR and DPA 2018 provide the primary right of access to health records. The NHS and private healthcare providers typically process medical records access requests under data protection law.

In the EU: Member states have varying healthcare-specific access rights alongside the GDPR. Germany, France, and others have national laws governing patient access to medical records that may have different procedures or timelines.

In Canada: Provincial health privacy laws (Ontario's PHIPA, Alberta's HIA) provide patient access rights that are separate from PIPEDA. See our HIPAA vs PIPEDA guide for the Canadian healthcare privacy framework.

Common DSAR Complications in Healthcare

The medical exemption. Under DPA 2018 Schedule 3, Paragraph 2, personal data processed by a health professional can be withheld if disclosure would be likely to cause serious harm to the physical or mental health of the data subject or another person. This is a narrowly applied exemption — the harm must be serious and likely, not merely possible or uncomfortable.

A health professional must be consulted before relying on this exemption. The organization cannot make the decision unilaterally. In practice, this means a clinician (typically the treating physician) must review the records and form a judgment about whether disclosure would cause serious harm.

Third-party clinical information. Medical records frequently contain information about other individuals — family members mentioned in clinical notes, other patients referenced in group therapy records, referral letters from other clinicians. This third-party data must be redacted unless the third party consents to disclosure or it is reasonable to disclose without consent.

Deceased patients. Data protection rights generally do not extend to deceased individuals under GDPR or UK GDPR. However, the Access to Health Records Act 1990 (UK) provides a right of access to the health records of deceased persons for personal representatives and individuals who may have a claim arising from the death. Healthcare organizations must understand which framework applies.

Genetic and biometric data. Under GDPR Article 9, genetic data and biometric data are special categories of personal data requiring a specific legal basis for processing. DSAR responses involving these data types must be handled with particular care regarding security and accuracy.

Healthcare DSAR Workflow Additions

1. Determine the applicable access framework. Is this a data protection access request, a patient access request under healthcare legislation, or both? The answer affects the procedure, timeline, and exemptions available.
2. Involve a health professional. If the medical exemption may be relevant, have a clinician review the records before deciding what to disclose.
3. Review for third-party clinical data. Medical records almost always contain references to other individuals. Apply redaction systematically.
4. Consider the format. Medical records may include imaging, test results, and clinical notes in specialized formats. The response should be in a form the individual can understand (UK GDPR Article 12(1)).

Legal Professions

Legal Professional Privilege

Legal professional privilege (LPP) is the most significant exemption in DSAR processing for law firms and legal departments. Under DPA 2018 Schedule 2, Part 4, Paragraph 19, personal data that consists of information in respect of which a claim to legal professional privilege could be maintained in legal proceedings is exempt from the right of access.

There are two types of LPP:

Legal advice privilege: Confidential communications between a client and their legal adviser made for the purpose of giving or obtaining legal advice. This applies regardless of whether litigation is contemplated.

Litigation privilege: Confidential communications between a client and their legal adviser, or between either of them and a third party, made for the dominant purpose of actual or contemplated litigation.

Common DSAR Complications in Legal

Client data vs case data. A law firm holds personal data about its clients (contact details, billing information, engagement terms) and personal data within case files (witness statements, correspondence, evidence). The client is generally entitled to their own personal data in both categories, but privilege may attach to specific communications or legal analysis.

Opposing parties. When someone involved in a legal matter (but who is not the firm's client) submits a DSAR, the firm must provide their personal data while protecting privileged material and client confidential information. This requires careful review and redaction.

In-house legal departments. Corporate legal departments face the same privilege issues when the organization receives a DSAR from an employee or customer whose personal data appears in privileged communications. The privilege belongs to the organization (the client), not the legal department, so the decision to waive privilege must be made at the appropriate level.

Ongoing litigation. If a DSAR is received from an opposing party in ongoing litigation, the legal claims exemption (DPA 2018 Schedule 2, Part 1, Paragraph 5) may apply in addition to LPP. Data that is necessary for the establishment, exercise, or defense of legal claims can be withheld. However, this exemption must be applied narrowly — it does not permit withholding all data simply because litigation exists.

Legal Sector DSAR Workflow Additions

1. Privilege review. Before compiling a response, have a qualified lawyer review the documents for privilege. This cannot be delegated to non-legal staff.
2. Separate privileged from non-privileged material. Create a privilege log documenting what has been withheld and the basis for the privilege claim.
3. Assess conflict of interest. If the requester is an opposing party, consider whether responding to the DSAR creates any conflicts with duties owed to the firm's client.
4. Coordinate with the client. If the DSAR involves client matter data, consider whether the client should be informed (unless doing so would prejudice the requester's rights).

Building a Sector-Aware Workflow

Regardless of your industry, the core DSAR workflow remains the same. What changes in regulated industries is the review and exemption stage. Here is how to adapt:

1. Maintain a sector-specific exemption checklist. In addition to the standard GDPR/DPA exemptions, list the sector-specific exemptions relevant to your industry (AML tipping off, medical exemption, legal privilege, etc.). Check this list for every DSAR.

2. Involve sector specialists. Compliance officers in financial services, clinicians in healthcare, and qualified lawyers for privilege review. These are not optional consultations — they are necessary for correct exemption application.

3. Document sector-specific reasoning. When applying a sector exemption, document not just which exemption you relied on, but the specific regulatory provision, the reasoning, and who made the decision. This level of detail is essential for defending your decisions during regulatory investigations.

4. Train your DSAR team on sector overlaps. The people handling DSARs need to understand how data protection law interacts with your sector regulations. Generic DSAR training is not sufficient in regulated industries.

For more on exemptions generally, see our DSAR exemptions guide. For guidance on redacting third-party data, see our third-party data redaction guide.

Related Guides

• DSAR Exemptions — when you can withhold data
• Third-Party Data in DSARs: Redaction Guide — handling data about other people
• Building a DSAR Workflow — the standard process

References

• GDPR Article 17(3): Exemptions to the right to erasure. Article 17
• DPA 2018 Schedule 2: Exemptions. DPA 2018
• DPA 2018 Schedule 3: Health, education, and social work exemptions. DPA 2018
• MiFID II: Record-keeping requirements. EUR-Lex
• Access to Health Records Act 1990: Legislation.gov.uk