Subject Access Requests in Microsoft Teams: finding the messages a SAR or DSAR covers
A subject access request, a SAR or DSAR under UK GDPR, or a legal request still covers everything an organisation holds about a person, including the conversations that now happen in Microsoft Teams and Slack. That data feels ephemeral, but it persists, it is scattered, and finding all of it by the deadline is genuinely hard. The organisations that cope put capture in place before a request arrives, because once one lands the clock is already running and anything edited or deleted before capture began is usually gone. Here is why, and how to be ready.
For years the answer to a subject access request lived in two places, email and a handful of shared drives. That is no longer true. A large part of the working day now happens in Teams and Slack, in channels, threads and direct messages, and that is where decisions get made, opinions get shared and personal data gets discussed. The obligation to find and produce that data has not changed at all. What has changed is that the data has moved somewhere far harder to search, and most organisations have not caught up.
C4C is an independent technology consultancy and an accredited Mimecast partner. We help organisations find, keep and produce what people say in Teams, Slack and email, on deadline, using the tools you already have where they are enough and Mimecast Aware where they are not. Ask us for a compliance review and we will tell you where the gaps are.
A subject access request and an eDiscovery request both reach collaboration data, not just email. Teams and Slack feel throwaway, but the messages persist, scattered across channels and direct messages, edited and deleted over time, with no unified way to search one person's whole footprint. The native export tools are slow and limited. Meeting the deadline reliably means capturing that data into a searchable, immutable store you can actually query, preserve and defensibly delete. That store has to exist before the request arrives: a capture tool records from the day it is switched on, so it cannot give you back what was edited or deleted before then.
The data has moved, the obligation has not
Under UK GDPR, an individual has a right of access to the personal data you hold about them. That right does not stop at the inbox. If someone has been discussed by name in a Teams channel, mentioned in a Slack thread, or is the subject of a direct message between two managers, that is personal data within scope, and you are expected to find it and produce it. The same is true when a regulator or a court asks. The channel the conversation happened in is irrelevant to the obligation. The only thing that changes is how hard it is to comply.
This is where many organisations quietly carry a risk they have never tested. They can search email in minutes. Ask them to produce every message about one named person across two years of Teams and Slack activity, and the honest answer is often that they are not sure they can, certainly not quickly, and certainly not with confidence that nothing was missed.
What a subject access request actually demands
A subject access request is not a polite enquiry you can answer at leisure. It carries a statutory clock and a duty to be thorough.
- A right of access to their personal data. The individual can ask for the personal data you hold about them, and you must provide it, wherever within your systems it sits, including collaboration tools.
- A one month deadline. You must respond without undue delay and within one month of receiving the request. You can extend by up to two further months where the request is complex or you have received a number of requests from the same person, but you must tell the person, and why, within the first month.
- The clock can pause, but only for two reasons. Since the Data (Use and Access) Act 2025, if you genuinely need the person to clarify what they want, the one month clock stops on the day you ask and restarts the day after they reply. If you need proof of identity, the clock does not start until you receive it. Neither is a way to buy time for a slow search.
- A duty of reasonable effort. You must carry out a reasonable and proportionate search, a standard the 2025 Act now writes into law. Not knowing where the data is, or not having the tools to find it, is not an excuse the process makes room for.
The clock pauses for clarification or identity checks, not because the data is inconvenient to reach. If it takes your team two weeks of manual effort to trawl channels and exports, that is two weeks gone from a one month window, on a single request. Source: ICO guide to subject access.
Not sure where you stand? Take the SAR readiness check: ten questions on Teams and Slack, a plain score and the specific gaps.
Why it has to be in place before the request
Most organisations look at collaboration capture for the first time when a request lands. By then the most useful moment has passed.
- The clock leaves no time to buy a tool. You have one month, paused only for clarification or proof of identity. Choosing, contracting, connecting and testing a capture platform rarely fits inside that, alongside the search itself.
- Capture starts when you switch it on. A capture platform keeps a full record from that day, including edits and deletions, and Mimecast reports that around one in 53 collaboration messages is edited or deleted. Existing messages can often be imported, but an export only holds messages as they stand now, so an edit or deletion made before capture began usually leaves no record. Source: Mimecast Aware.
- Retention set in advance is defensible. A retention policy applied consistently before any request explains why older messages no longer exist. Changes made after a request arrives look like the opposite, and deliberately removing information to stop it being disclosed is an offence, covered below.
- Legal holds start when a dispute is anticipated. If the conversation that matters is already in Teams or Slack, a hold you can only place after the claim arrives is a hold placed too late.
- The second request costs as much as the first. Without capture, every request means the same manual trawl through exports, against the same deadline.
Put capture and retention in place while it is a planned project rather than an emergency, and a request becomes a search you run, not a scramble you hope survives the deadline.
If a request that reaches Teams or Slack has already landed, the first week decides whether you meet the deadline. Preserve the data before anything else, scope the search to the person across chats, channels and meetings, and decide early whether you need clarification. If you want a hand with a live request, tell us the deadline or email hello@c4cgroup.co.uk and we will come back to you within one working day. Then fix it before the next one.
Can you delete Teams messages once a request arrives?
No. Once a subject access request has been received, it is a criminal offence to alter, deface, block, erase, destroy or conceal information with the intention of preventing its disclosure. Data Protection Act 2018, section 173. That covers quietly tidying up a Teams chat or Slack thread after the request lands, however embarrassing its content. Messages removed earlier under a genuine, consistently applied retention policy are different: they are no longer held, so they do not have to be produced, but you should be able to show the policy that removed them. And deleted does not always mean gone. Teams messages often persist in retention holds, compliance records or a capture platform, in which case they are still held and still in scope. This is not theoretical: in September 2025 the ICO announced that a care home director had been found guilty under section 173 after blocking, erasing or concealing records to prevent their disclosure following a request, and ordered to pay a £1,100 fine and £5,440 in costs. Source: ICO.
The ICO has reprimanded organisations for slow subject access, including United Lincolnshire Teaching Hospitals NHS Trust, which missed the one month limit on 32 percent of requests, and City of Edinburgh Council, which missed it on 40 percent. It also says there is no exemption for archived or backed up data just because of how it is stored, and that personal data staff hold on their own devices may need to be considered. Sources: ICO, United Lincolnshire, ICO, Edinburgh, ICO guidance on searching. Not sure where you stand? Take the SAR readiness check.
Why Microsoft Teams and Slack are so hard to search
Collaboration platforms were built for fast conversation, not for records management, and it shows the moment you need to produce something.
- It feels ephemeral, but it persists. A chat feels like a passing remark, yet the message is stored and discoverable. People speak more casually in Teams than they ever would in an email, which makes the content more sensitive, not less.
- Messages get edited and deleted. A message can be changed or removed after the fact, so a simple export taken today may not reflect what was actually said. Establishing the true record means capturing the full context, including edits and deletions, as they happen.
- The data is scattered. One person's footprint is spread across public channels, private channels, group chats and direct messages, in more than one workspace, and often across both Teams and Slack at once.
- Native tools are limited. The built in export and eDiscovery features can be slow, awkward to scope to a single person, and inconsistent across platforms. There is rarely one unified search that spans a named individual's entire activity.
eDiscovery and legal hold, the same problem with higher stakes
Everything above applies just as much when the request comes from litigation or a regulatory investigation. In eDiscovery you must not only find the relevant collaboration data, you must preserve it against change or deletion the moment a matter is anticipated, then review and produce it. A legal hold that only covers email while the real conversation happened in Slack is a hold with a hole in it. The ability to place an immutable hold across collaboration channels, with an audit trail, is what turns a nervous manual scramble into a defensible process.
Regulated sectors have a further duty
For firms in regulated sectors, the requirement goes beyond responding to requests. Obligations to capture and retain business communications, and in some cases to supervise them, increasingly extend to the collaboration channels where business is now actually conducted. If staff are agreeing things in Teams and Slack, those channels fall within the same record keeping and oversight expectations that once applied only to email and phone, and a gap in capture is a gap in compliance.
These are two different problems that people often conflate. Stopping threats inside collaboration tools, malicious links, impersonation and risky sharing, is a security question, and we cover it in securing collaboration tools. Finding, preserving and producing the data for a subject access request or a court is a compliance and records question. You can be strong on one and exposed on the other. This guide is about the second.
What good looks like
A collaboration estate you can actually answer for shares a few characteristics, and none of them depend on hoping the native exports are enough on the day.
- Full context capture. Messages from Teams, Slack and similar tools are collected as they happen, including edits and deletions, so the record reflects what was really said.
- Search across a person, not a channel. You can pull one named individual's entire footprint across every workspace, channel and direct message in a single query, rather than stitching together partial exports.
- Retention with defensible deletion. Data is classified and kept for as long as policy and regulation require, then removed on a clear schedule, so you are neither hoarding nor destroying prematurely.
- Immutable holds and audit trails. When a matter arises, relevant data can be preserved beyond change or deletion, with a record of who did what and when.
- The ability to erase. When a valid right to erasure applies, you can remove a person's data reliably, which is the other side of the same coin as finding it.
Where Mimecast Aware fits
Aware does the most good when it is running before you need it, because what it captures from day one is what you will be able to produce later. This is the specific gap Mimecast Aware is built for. It collects, processes and preserves collaboration data at scale from Microsoft Teams, Slack and Zoom, using native API and webhook integrations, and it captures the full conversation context including edits, deletions and emojis, so the record is complete rather than a snapshot. It gives legal, compliance, HR and security teams granular search across that data, classifies it by type, sensitivity and retention need, applies retention policies, supports immutable holds for investigations with audit trails, and can carry out automated removal of a user's data when that is required. In other words, it turns the scattered, awkward reality of collaboration into something you can query and produce against. Worth noting that Mimecast Cloud Archive also captures Teams data as part of a wider archive, which we cover in the archiving, retention and eDiscovery guide. We are a strategic Mimecast partner and recommend Aware where the collaboration compliance and discovery burden genuinely justifies it, rather than as a default, because a small organisation with light collaboration use may not need it. If you are weighing it against the Microsoft tools you already own, our Aware vs Purview eDiscovery comparison sets out when Purview is enough.
Not sure whether you could answer a subject access request that reaches your collaboration tools? Our free, interactive Email Security Assessment covers the collaboration and compliance dimensions alongside the rest of your email and collaboration posture, and returns an instant, personalised view of where the gaps are. It is a quick, honest place to start.
Be ready before the next request lands
Could you produce every Teams and Slack message about one person, on deadline, including what was edited or deleted? C4C helps organisations get collaboration data under control, so a subject access request, an eDiscovery order or a regulatory ask becomes a search rather than a scramble. Independent, and open about our Mimecast partnership.
Prefer email? Reach us directly at hello@c4cgroup.co.uk.
Frequently asked questions
Does a subject access request cover Microsoft Teams and Slack?
Yes. A subject access request covers all the personal data you hold about an individual, wherever it lives, and that includes messages in Microsoft Teams and Slack. If someone is named or discussed in a channel, thread or direct message, that content is in scope, and you are expected to find and produce it just as you would an email.
How long do you have to respond to a subject access request?
Under UK GDPR you must respond without undue delay and within one month of receiving the request. You can extend by up to two further months where the request is complex or the same person has made a number of requests, but you must tell them, and why, within the first month. Since the Data (Use and Access) Act 2025 the clock pauses while you wait for a clarification you genuinely need, and does not start until you have any proof of identity you asked for. It does not stop because the data is hard to reach.
Can you pause the deadline for a subject access request?
Only in two situations. If you genuinely need the person to clarify what they are asking for, the one month clock stops on the day you ask and restarts the day after they reply. If you need proof of identity, the clock does not start until you receive it. These rules come from the Data (Use and Access) Act 2025 and are reflected in the ICO guidance. Neither pauses the clock because a search is slow.
When should we put a Teams and Slack capture tool in place?
Before a subject access request or dispute arrives. A capture tool records messages, including edits and deletions, from the day it is switched on, and an edit or deletion made before then usually leaves no record. Buying and connecting a tool also rarely fits inside a one month deadline. Put capture and retention in place as a planned project, so a request becomes a search rather than a scramble.
Why is it hard to find Teams and Slack data for a DSAR?
Because the data is scattered across public channels, private channels, group chats and direct messages, often in more than one workspace, and messages get edited and deleted over time. The native export tools are slow and awkward to scope to a single person, and there is rarely one unified search across a named individual's entire footprint, so a thorough manual search eats into your one month deadline.
What happens if Teams messages are deleted before a subject access request?
It depends on when they were deleted. Messages removed in the ordinary course of a retention policy before the request arrived are no longer held and do not have to be produced, though you should be able to show the policy that removed them. Once a request has been received, altering, erasing or concealing personal data to prevent its disclosure is an offence under the Data Protection Act 2018, so deleting after that point is the one thing not to do. Deleted Teams messages also often persist in retention holds, compliance records or a capture platform, so they may still be in scope and still discoverable.
How do you find and export Microsoft Teams messages for a subject access request?
Through the Microsoft 365 compliance tools, Purview content search or eDiscovery, scoped to the individual’s name and identifiers across chats, channels and meetings, then exported for review and redaction. The native search is workable for one clear cut request and slow for anything scattered across many teams, private channels and deleted history. Organisations that receive requests regularly capture Teams data into a dedicated searchable store, so the search becomes a query rather than a project.
What is the difference between securing Teams and capturing Teams data?
Securing Teams is a security question, stopping threats inside collaboration tools such as malicious links, impersonation and risky sharing. Capturing Teams data is a compliance and records question, being able to find, preserve and produce the data for a subject access request, eDiscovery or a regulator. They are different problems, and an organisation can be strong on one while exposed on the other.
Can you put a legal hold on Teams and Slack messages?
You can, but only if you have the means to preserve that data against change or deletion the moment a matter is anticipated. A legal hold that covers email while the real conversation happened in Slack leaves a gap. The ability to place an immutable hold across collaboration channels, with an audit trail of who did what and when, is what makes the process defensible.
How does Mimecast Aware help with subject access requests?
Mimecast Aware captures collaboration data from Microsoft Teams, Slack and Zoom, including edits and deletions, into a searchable store. It gives legal, compliance, HR and security teams granular search across that data, classifies it, applies retention policies, supports immutable holds for investigations with audit trails, and can automatically remove a user's data when required. That turns a scattered manual scramble into a search you can run and trust.