DSAR automation that answers every request inside its legal clock, with no other person's data released
Every request answered inside its legal clock, with no other person's data released.
See one case, screen by screen ↓DSAR Automation finds, reviews and redacts personal data and drafts replies to data subject requests. Eight agents read each request, check identity in proportion to the risk, sweep every connected system, cut other people's data with a reason for each cut, re-check the package independently and draft the reply. The privacy analyst approves every release, the DPO signs extensions and system owners confirm every deletion.
How to choose AI solutions for back-office and enterprise work →
Updated
Every request starts a clock: one month under GDPR and UK GDPR, 45 days under the California law and the other US state laws, 15 days under Brazil's LGPD. Answering means logging the right and the law, checking identity without asking for more than the risk needs, then emailing a dozen system owners — CRM, HR, support, mail, the data lake, call recordings — and waiting for their exports in a shared drive.
Then the hard part. Which of those records are really hers, and which belong to a namesake in another city? Where is another customer's phone number, or a colleague's opinion, hidden in an email thread or a call transcript? Which emails with outside counsel are privileged? And for a deletion, which records sit under a litigation hold? Release someone else's data and you have a breach of its own; delete under a hold and you have spoliation; miss the clock and you have a complaint to the regulator.
Estimated split for a typical access request across a dozen systems, by hand and with the solution, in working hours.
Eight agents verify, sweep every system, cut and re-check each package; the privacy analyst approves and system owners confirm every deletion.
Elena Marchetti, a Climate Services customer in Milan who also applied for a field-engineer job in 2024, disputes an €89 call-out fee. On Fri 25 Sep 2026 at 21:14 she asks Kestrel & Vane Group for all the personal data it holds about her, including call recordings. Here is how Amara Lindqvist and the agents answer it, screen by screen, in the working solution.
Amara's home screen shows 47 open requests, 6 due in 7 days and none overdue, one forecast to miss with an extension proposed, and 99.6% on time in 2026 — 1,629 of 1,636 closed. Above the table sit the six things that need her today: an approval, an extension, a duplicate, a phone check, a refusal waiting for the DPO and 38 deletions waiting for a system owner.
“DSR-4417 is ready for the release check and your approval · Elena Marchetti · GDPR access · 312 records, 486 cuts · day 19 of 30.”
The clock runs across the top: received and verified on day 0, swept on day 3, reviewed on day 17, due Sun 25 Oct. Identity was checked at the Standard tier — signed-in portal session, email on file, customer number — with no ID document asked. On Mon 28 Sep, 09:02–11:41, one sweep agent per system searched all nine read-only: 41 records in the customer CRM, 9 in HR and recruiting, 63 in support tickets, 118 in mail and chat, 52 in the data lake, 29 call recordings. Billing, Marketing and Field service had nothing.
“No ID document asked: an access request from a signed-in customer, with no special-category data in scope. Rule ID-2.”
Every hit is scored against the verified identity. Below 0.80 a record is parked with its reason, not returned: 23 across the systems. In the CRM there are six — another Elena Marchetti in Turin, born 1971 (0.41); an Elena Marchettini in Milan (0.36); an E. Marchetti in the same building with a different first name on the contract (0.52); and the second contact on her own account, her spouse (0.63).
“Below 0.80 a record is parked with its reason; it is never released unless a person includes it, with a reason.”
The redaction agent made 486 cuts in 70 records, each with its one-line reason and rule: other customers, staff below director, other job candidates, security information and quoted legal advice. Four records are withheld in full — three emails carrying outside counsel's advice on her disputed fee, confirmed as privileged by Margaret Chen-Ellis on 12 Oct, and an account-protection rule applied to her log-ins. The reply drafter wrote the letter in Italian and English, each section citing where it came from.
Found while drafting: “Her 2024 recruiting file is 19 months past its retention (RS-22: 6 months after the reserve list closed in Sep 2024). The reply says so and offers deletion.”
Amara runs the release check. A second agent, with no access to the first agent's notes, re-reads all 308 records from scratch, looking where first passes miss: numbers spoken in transcripts, attachments, text in images, file metadata. A minute later it blocks the release with one finding, in call transcript CR-26-0918 from 11 Mar 2026.
“1 finding blocks the release.” The release checker cannot release; it can only block with a finding.
In the transcript the contact-centre agent offers to ring back on “zero two, five five five zero, one eight four seven” — the callback number on the Bianchi account, another customer, not Elena's. The first pass looked for digits. The release checker proposes a cut under RD-01, other customer, with 0.98 confidence. Amara opens the record and reads it in place.
One click accepts the cut: 487 cuts in 71 records, release unblocked. The approval shows what she is signing — 308 records in 6 folders, 4 withheld, the release check passed with 1 resolved, the reply in Italian and English, delivery by secure portal for 30 days. She picks R1, “Complete, checked, released”, and her note goes on the record.
“Signing as Amara Lindqvist · Privacy analyst, Dublin · signature, time and reason go on the audit trail.”
The package goes to Elena through the secure portal, with the opening code sent by SMS to the phone on file and a link valid 30 days. The clock bar turns green at day 19, and every step — the plan, the sweep, the match, the cuts, the privilege, Amara's review, the release check, the accepted cut and the release — is on the request with who did it and when.
“Released on day 19 of 30 · 308 records, 487 cuts in 71 records, 4 withheld. Signed by Amara Lindqvist, reason R1.”
Jonas Albrecht in Munich asked for erasure under GDPR Art. 17. Of his 108 records, the deletion coordinator plans 90 to delete and 18 to keep: 6 CRM records under legal hold H-2026-014, a warranty dispute at the Munich Regional Court, and 12 billing records kept 10 years under German commercial and tax law. Rafael ticks that he checked the legal holds register and that no other duty applies, then confirms. The coordinator deletes, searches again to prove nothing is left, and tells the three recipients under Art. 19.
“Rafael Ortiz, the deletion coordinator asks you to delete 38 records about Jonas Albrecht in Customer CRM, and keep 6.”
Declan Murray, a former employee in Leeds, asked for his data under UK GDPR: 3,352 items, including 2,940 emails in 41 mailboxes and threads with 214 other employees in them, 46 under an employment tribunal hold. The clock watcher forecasts the finish on 18 Nov, after the 30 Oct due date, and proposes 30 Dec with the reasons and a drafted notice. Henrietta reads them and decides; only she can sign the extension.
“Forecast: the redaction agent has read 1,180 of 3,125 mail items; 1,945 are left, and review clears about 56 a day after legal review → 18 Nov.”
The same requests, seen by the five people who carry them — what their month looked like, and what it looks like now.
Eight agents verify, sweep every system, cut and re-check each package; the privacy analyst approves and system owners confirm every deletion.
Reads web forms, emails, call notes and letters; decides the right, the law and the clock; finds identity points and duplicates; sends the acknowledgement.
Chooses the lightest identity check that fits the risk — signed-in session, email or SMS code, signed permission for an authorised agent — runs it and writes down why.
One per connected system, searching in parallel with the verified identifiers, scoring every record against the identity and parking look-alikes with a reason.
Cuts other people's data, privileged and exempt material, and explains each cut in one line with its rule.
Re-reads each final package from scratch, another way: spoken numbers, attachments, text in images, file metadata.
Writes the reply with purposes, recipients, retention, source and rights from the record of processing, in the requester's language.
Plans deletion and correction per system and record, checks holds and retention duties, sends owners their tasks, verifies by searching again and tells recipients.
Tracks every clock, forecasts the finish from the work left, proposes an extension with reasons in time, and reminds.
Approves; DPO extends; owners delete. The agents propose; a named person decides.
Ask about any request, record or deadline — or say what to do next. Every answer points to its source and opens the screen it came from.
What is left before DSR-4417 can go?
Two steps. The package is ready: 308 records from 6 systems, 486 cuts in 70 records, 4 withheld under legal privilege and security. First run the release check, the second agent's independent read; then approve with a reason code. It is day 19 of 30; due Sun 25 Oct.
Which requests could miss their deadline?
One: DSR-4398, Declan Murray, UK GDPR access. 3,352 items; at today's review pace the forecast finish is 18 Nov, after the due date of 30 Oct. The clock watcher has proposed an extension to 30 Dec with the reasons; the notice must reach him by 30 Oct. Six are due within 7 days, all on track.
Why was the Bianchi number cut?
In call transcript CR-26-0918 (11 Mar 2026) the agent read out a callback number in words — “zero two, five five five zero, one eight four seven”. It belongs to the Bianchi account, another customer, not to Elena Marchetti. The first pass looked for digits; the release checker reads spoken numbers. Rule RD-01, other customer.
Delete Jonas Albrecht's data now
Not all of it. 90 of his 108 records can go. 6 CRM records are under legal hold H-2026-014 (warranty dispute, Munich) and 12 billing records must be kept 10 years by German commercial and tax law. The 38 CRM deletions wait for Rafael Ortiz to confirm the hold check.
13 screens from the working solution, on its sample data. Pick one to see it large.
The rules the agents work to are settings. Every change is a new version, and the DPO approves it before it goes live.
| Setting | Default | Choose from |
|---|---|---|
| GDPR and UK GDPR clock | One month, two further months to extend | Set per law: GDPR, UK GDPR, Swiss FADP, CCPA, Virginia, Colorado, Texas, Oregon, Indiana, LGPD |
| CCPA and US state clocks | 45 days, 45 more days; acknowledge within 10 business days | Answer within, extension, acknowledge within and reminders, per law |
| Reminders | 7 and 3 days left | Set per law |
| Identity tiers | Standard (ID-2), Enhanced (ID-4), Authorised agent (ID-6), Special category (ID-8) | Each tier in use or not |
| ID documents | Never asked unless the Enhanced check fails; never stored | On · off |
| Redaction rules | RD-01 other customer, RD-02 staff, RD-03 other candidate, RD-05 security, EX-01 legal privilege | Each rule on or off · RD-04 directors' names off by default |
| Look-alike threshold | 0.80 | A slider: below it a record is parked, not included |
| Release check before any release | Must pass; cuts burned into the files | On · off |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (Gartner, Market Guide for Subject Rights Request Automation, 2023 — $1,524 a request by hand; Data Privacy Trends 2025, an industry survey — deletion requests up 567% since 2021). Clocks: GDPR Art. 12(3); Cal. Code Regs. tit. 11 § 7021; LGPD Art. 19. People, companies and requests named on this page are fictional — characters and sample data in the working solution.
DSAR Automation finds, reviews and redacts personal data and drafts replies to data subject requests. Eight agents read each request, check identity in proportion to the risk, sweep every connected system, cut other people's data with a reason for each cut, re-check the package independently and draft the reply. The privacy analyst approves every release, the DPO signs extensions and system owners confirm every deletion.
The identity verifier picks the lightest check that is enough for the risk — a signed-in portal session or a code to the email on file for ordinary access, a one-time code to the phone on file for a deletion from an unknown email, signed permission for an authorised agent — and writes down why. It never asks for an ID document unless the tier needs it, and never stores one.
Sweep agents park records that only resemble the requester, below a 0.80 match score, for a person to decide. The redaction agent cuts other customers', staff and candidates' data with its rule. Then a second agent re-reads the whole package another way — spoken numbers, attachments, text in images, metadata — and can block the release until the analyst resolves its finding.
Yes. The deletion coordinator splits every record into delete or keep, with the hold or retention duty that keeps it, and sends the system owner a task. Nothing is erased until the owner confirms the legal-hold check; afterwards the system is searched again to prove nothing is left, and each recipient is told under GDPR Article 19.
The intake agent sets the clock from the right and the law — one month under GDPR, 45 days under the US state laws, 15 days under LGPD. The clock watcher forecasts each finish from the work left and proposes an extension with its reasons before the first period ends, so the DPO can sign it and the notice reaches the person in time.
Yes. The agents never reject or close a request, decide an exemption, extend a clock or delete on their own. The privacy analyst approves every package with a reason code, the DPO signs extensions and refusals, legal counsel confirms privilege, system owners confirm deletions, and no one signs what they prepared.
Yes. Laws and clocks, identity tiers, connected systems and their owners, redaction rules, the look-alike threshold, roles and notifications are all settings. Every change is saved as a new version that the DPO approves before it goes live.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your record of processing, retention schedule, holds register and a sample of past requests — and it goes live once every quality gate has passed. We will walk you through it on your own requests first.
Every high-risk AI system documented, cited and signed before 2 December 2027.
1-min demoPrivacy Impact AssessmentEvery new project assessed before launch, with each answer traced to its source.
1-min demoData Processing Agreement ReviewEvery supplier DPA checked on all eight Article 28 terms, redlined from your playbook.
1-min demoWe'll run DSAR Automation on a sample of your own past requests and the systems they touch.