I did some quick searching, and my gut feeling would appear to be correct: It is not legal to delete user data in order to avoid fulfilling a subject access req

I did some quick searching, and my gut feeling would appear to be correct: It is not legal to delete user data in order to avoid fulfilling a subject access request. It is okay if data has been routinely modified or deleted, but it must not be a result of the access request. Quoting the Information Commisioner's Office: Q: We have received a request but need to amend the data before sending out the response. Should we send out the “old” version? A: It is our view that a subject access request relates to the data held at the time the request was received. However, in many cases, routine use of the data may result in it being amended or even deleted while you are dealing with the request. So it would be reasonable for you to supply information you hold when you send out a response, even if this is different to that held when you received the request. However, it is not acceptable to amend or delete the data if you would not otherwise have done so. Under the DP Bill, it is an offence to make any amendment with the intention of preventing its disclosure.