Respond to subject access requests faster

The problem

You've received a subject access request (SAR) and need to find, review, and redact personal data across emails, spreadsheets, case notes, and shared drives within one calendar month. Manually searching every system, reading every document, and redacting third-party information takes staff days or weeks. Larger charities might get several SARs a month. Miss the deadline and the ICO gets involved.

The solution

Use an LLM to help search, identify, and redact personal data across your documents. The AI reads through documents looking for mentions of the data subject, flags relevant sections, and suggests redactions of third-party information. You still review everything - the AI just cuts the searching and reading time from days to hours.

What you get

A compiled set of documents containing the data subject's personal data, with third-party information redacted and a log of what was found where. You get a checklist of systems searched, documents identified, and redactions applied. Staff can focus on reviewing and making judgement calls rather than endless searching.

Before you start

• A valid subject access request received by your charity
• Access to the systems where personal data is stored (CRM, email, shared drives, case management)
• Understanding of your data map - where personal data lives across your organisation
• Paid AI subscription recommended - you need a tool that won't train on the data you input. Claude Pro or ChatGPT Plus with data training disabled.
• CRITICAL: Only use AI tools where your data processing agreement permits it. Do NOT paste raw personal data into free-tier AI tools.

When to use this

• You receive SARs and the manual search process takes staff days
• Your data is spread across multiple systems and formats
• You need to redact third-party information from documents before disclosure
• You handle enough SARs that efficiency matters (2+ per quarter)

When not to use this

• Your CRM has a built-in SAR export feature that covers most of your data
• The request involves highly sensitive safeguarding data (handle entirely manually with your safeguarding lead)
• You don't have a paid AI subscription with appropriate data processing terms
• The SAR is complex enough to need legal advice (AI won't help with the legal judgement calls)

Steps

1. 1

   Verify the request and plan your search

   Confirm the identity of the requester and check the scope of the request. List every system where their data might exist: CRM, email, shared drives, case notes, finance system, HR records. Create a checklist. You have one calendar month from receipt (not 30 days - a calendar month runs to the same date next month).

2. 2

   Export data from structured systems first

   Pull records from your CRM, finance system, and any databases that have search functions. These are the easy ones - export to PDF or CSV. Don't use AI for this step; just use each system's built-in search and export.

3. 3

   Use AI to search unstructured documents

   For emails, Word documents, meeting notes, and other unstructured text: paste batches into Claude and ask it to identify any mentions of the data subject by name, reference number, or other identifiers. Prompt: 'Review this document and identify all mentions of [name/identifier]. For each mention, quote the relevant paragraph and note what personal data it contains.' Work through documents in batches.

4. 4

   Identify what needs redacting

   Before you hand over documents, you need to remove third-party personal data (other people's names, contact details, opinions about others). Paste each relevant document into Claude and ask: 'This document will be disclosed to [name] under a subject access request. Identify any third-party personal data that should be redacted before disclosure - other people\'s names, contact details, or information that would identify them.' Review every suggestion.

5. 5

   Apply redactions and compile the response

   Apply redactions in your documents (use your word processor's redaction tools, not just black highlighting which can be removed). Compile everything into a structured response with a covering letter explaining what you found, what was redacted and why, and any exemptions applied. The AI can draft the covering letter.

6. 6

   Review everything before sending

   A second pair of eyes is non-negotiable. Have someone else check that all third-party data is properly redacted, no personal data was missed, and the response is complete. Check against your original system checklist - did you search everywhere?

Tools

Resources