Artificial Intelligence and the Future of Subject Access Request: Transforming Data Disclosure Under the Uk GDPR

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

This article critically examines the transformative impact of Artificial Intelligence (AI) on the administration of Subject Access Requests (SARs) under the United Kingdom General Data Protection Regulation (UK GDPR). As organisations contend with exponential growth in electronically stored information, traditional manual disclosure practices have become increasingly unsustainable. Through doctrinal legal analysis, comparative regulatory research and documentary review, this study evaluates how AI technologies including Large Language Models, Natural Language Processing and semantic search are reshaping SAR administration while assessing the adequacy of existing legal frameworks. The research demonstrates that current UK data protection legislation remains sufficiently adaptable to regulate AI-assisted disclosure through its principles-based approach, though meaningful human oversight remains legally indispensable for interpreting statutory exemptions and balancing competing rights. The study identifies explainability as a defining governance challenge and proposes an original AI-Augmented Disclosure Governance Framework (AIADGF) integrating legal obligations, organisational governance and AI-enabled technologies into a structured eight-stage model. The framework positions AI as an augmentation of professional legal judgement rather than a replacement, ensuring accountability under Article 5(2) UK GDPR. The article contributes to emerging scholarship at the intersection of AI, information governance and data protection law while offering practical recommendations for policymakers, regulators and organisations seeking to deploy AI responsibly within SAR processes. It concludes that AI should serve as an instrument for strengthening data protection principles through improved transparency, consistency and procedural fairness.