— Subject access requests —
Subject access requests, handled.
Fixed price, on time, every redaction checked twice.
An employee asks for "all my personal data". Thirty days later you need thousands of emails searched, other people's details removed, exemptions decided and a lawful response sent. We do all of it for you, at a price agreed before we start.
— The problem —
Why DSARs hurt
The clock is short.
One month under the GDPR (30 days in Switzerland), and it starts the day the request arrives.
The volume is huge.
A single mailbox search can produce 3,000 pages.
The risk runs both ways.
Leave out too much and you face a complaint to the regulator. Leave in a colleague's health details and you have a data breach.
The usual options are slow or costly.
Law firms bill by the hour. Doing it in-house takes HR and IT off their real work for weeks.
— What we do —
From request to response pack
- 1
Scope.
We read the request, confirm the deadline, and advise whether to clarify or extend.
- 2
Collect.
We tell your IT exactly what to export, or help them do it.
- 3
Sort.
Duplicates out, out-of-scope material set aside, everything indexed.
- 4
Redact.
Third parties' personal data removed, line by line. Staff acting in their work role are handled as the law allows.
- 5
Recommend.
Exemptions (legal privilege, negotiations, management planning, confidential references) recommended, each with a written reason, for you to adopt.
- 6
Check, twice.
Two independent reviews of the finished pack, with a written record of each.
- 7
Deliver.
A response pack ready to send, the covering letter with everything the law requires, and a schedule of what was withheld and why. Delivered by secure link, password sent separately.
You stay the controller and send the response. Where a privilege or litigation decision is needed, we flag it and your lawyers make the final call.
See a sample pack
A fictional employee request, handled end to end: the redacted documents, the redaction schedule with reasons, and the cover letter. It shows a finished pack after review.
Download the sample (PDF)— Add-on: tribunal bundles —
Going to tribunal? We build the bundle too.
The same documents often end up in an employment tribunal. Send us the pile and we return one hearing file, built to the Presidential Guidance on electronic documents.
- One PDF with a hyperlinked index, and page numbers that match the PDF page numbers.
- Chronological within sections; bookmarks for the key documents.
- Exact and near duplicates out, and email chains reduced to the fullest copy, with a log of everything removed.
- Searchable text on every page, scans included.
- Redaction of irrelevant third-party data, if you want it, on the subject access prices.
You decide what is relevant and agree the contents with the other side. We build it.
— Governance —
Control, Accountability, Provability
Control.
Your data is processed for your request only, and deleted when the job closes. We give you the list of where it is processed and by whom before we start.
Accountability.
Every redaction and every exemption is logged with its reason, ready if the requester or the regulator asks.
Provability.
Each pack ships with its two review records and a file list with checksums, so you can show what was sent.
— Who it's for —
Built for the people who get the request
Employers
facing an employee DSAR in a grievance, dismissal or tribunal.
Law firms
that want a reliable back office for DSAR redaction, under their own name.
Outsourced DPOs and privacy consultancies
handling requests for many clients.
HR consultancies
whose clients get the odd DSAR, and who want it handled under their own name.
EU and EEA (GDPR), Switzerland (revFADP), and the UK (UK GDPR). Other countries on request, with your local counsel making the legal calls.
“I am most impressed by James, because he has gone out there and learned about it, producing an excellent tool.”
Read the Satswana case study— Free guide —
What a subject access request really costs
Four pages for HR consultancies, employment-law firms and the organisations they advise: where the time goes in a DSAR, a table to work out your own cost, where it goes wrong, and a checklist before the pack goes out.
— FAQ —
Questions we get asked
How fast?
Before the statutory deadline (one month; 30 days in Switzerland) when the full export reaches us at least 10 working days before it. Scoping and a fixed quote usually within one working day of seeing the request. Urgent turnaround is quoted separately.
Do you give legal advice?
No. We prepare the pack and recommend scope, third-party redactions and exemptions, each with a written reason. You, or your solicitor or DPO, make the final calls. Privilege and litigation strategy stay with your lawyers. In Germany, France and Austria we work alongside a locally admitted lawyer, who makes the legal calls.
Where is the data processed?
We list it for you before any data moves: our servers, our processors and their locations.
What languages?
English. Other languages on request.
Can you work under our name?
Yes. Law firms, HR consultancies and DPO providers can use us as a white-label back office, with 25% off our published prices. Our two-page partner pack is at doubleaigents.com/partner-pack.pdf.