Data Subject Access Requests
Locate, review, redact
GDPR-focused DSAR support: collected data reviewed to find what relates to the requester, with third-party and confidential information redacted.
The challenge
Access requests run on a tight clock, and one person's data is scattered across many documents.
Typical GDPR response window we work to
Agreed with you before review
Third-party and confidential data removed
Response set ready for release
How modern teams approach data subject access requests
Under the GDPR, organisations generally have one month to respond to an access request. A single requester can surface thousands of emails, chats and files, each of which may also contain other people's data or confidential information.
We agree a playbook with you, review the collected data to find what relates to the requester, and redact third-party and confidential information. The same approach works for other privacy laws with similar review needs.
We handle requests under UK GDPR and EU GDPR, Canada's PIPEDA, US state privacy laws such as California's CCPA, and the UAE's data protection laws, including the DIFC regime.
Locate and review
Collected data is reviewed to find what relates to the requester.
Redact
Third-party and confidential information is removed.
Built for GDPR
The same approach works for other privacy laws with similar review needs.
Go slow to go fast
We prove the approach on a small sample with you first, then scale. Here is how the work flows, and where AI carries the load versus where our attorneys apply judgement.
Technology where it adds value
An indicative view of how work is shared between AI and our attorneys at each stage. Judgement, protocol and sign-off always stay with people.
- 01
Agree playbook
5% 95%Scope, exemptions and redaction rules agreed.
- 02
Process the data
70% 30%Collected data de-duplicated, threaded and prioritised.
- 03
Review and redact
40% 60%Relevant data identified; third-party and confidential data redacted.
- 04
Deliver to client
15% 85%Verified response set delivered for release.
What you receive
A verified, redacted response set for your team to release to the requester.
Where it fits best
- Employee DSARs
- Customer access requests
- Litigation-linked requests
- Backlogs and peaks in volume
Pricing that fits the shape of the work
The attorney who scopes your work shares pricing up front. These are the models that typically suit data subject access requests.
Fixed fee
Best for
Defined projects, such as a CLM assessment or a contract clean-up.
How it is billed
One price for an agreed scope and outcome.
Unit rate with cap
Best for
Variable volume, such as document review or abstraction.
How it is billed
Per document or per contract, with a ceiling on total spend.
Managed team
Best for
Ongoing work, such as platform operations or monitoring.
How it is billed
A monthly fee for a dedicated team, scaled up or down with notice.
Hybrid
Best for
Programmes that mix a project with steady run work.
How it is billed
A fixed fee to build, then a unit rate or team fee to run.
What clients ask us
No. We deliver a verified, redacted response set to your team, who release it.
Related services
Due Diligence
Rules-based document review for any diligence exercise, from M&A and vendor onboarding to regulatory change, with findings, gaps and exposures extracted and checked by reviewers.
Contract Remediation
Counsel-guided repapering of live contracts after a regulatory, policy or business change, scaled to the deadline with a live status tracker.
Regulatory Survey
Validated multi-jurisdiction legal research, compared side by side, as a one-time report or continuous monitoring of change.
KYC
Sector-agnostic know-your-customer screening and documentation using your tools or online data sources, with consistent records for every entity.
Incident Response
Post-breach data review to identify affected individuals and their information, delivered as a validated, de-duplicated notification list.
Answer every request accurately and on time
We locate the requester's data, redact what should not be shared and deliver a response package that is ready to release.
Start a Conversation