When a data subject access request (DSAR) arrives, responding accurately and on time can put significant pressure on your team. Our data SAR redaction services give you the expert guidance and additional capacity you need to manage requests efficiently, remain compliant, and reduce the burden on your organisation.
Get help with SAR redaction when you need it most
We offer flexible services to help with SAR redaction. These can be used individually or combined, depending on your organisation’s needs:
- Search Support – Helping your teams extract the relevant data required for the subject access request, with live guidance to ensure accuracy and reduce the workload at later stages.
- Data Conversion & Deduplication – Converting raw data into a redactable format, removing duplicates, and organising the information so it’s ready for review – ideal for large employee requests.
- Redaction & Disclosure Support – Assisting with the secure redaction of data, with appropriate use of exemptions, ensuring the final disclosure bundle is safe and compliant for release.
Each of these SAR services are designed to reduce risk, improve efficiency, and ensure your organisation meets its legal obligations when handling DSARs.
DPAS has vast experience in supporting a variety of organisations in handling subject access requests, from one-off employee SARs, to large social care backlogs. DPAS is on hand to support organisations spanning the private, public, and third sector.
HOW CAN WE HELP?
DPAS can provide support in converting raw data to a redactable format (PDF). Using our specialist software we can also remove duplicate data – such as email threads.
Our conversion and deduplication services can be purchased as standalone services, and start from as little as £650.00.
DPAS can support you in responding to just one request – with no long term obligations. Perhaps you have received your first request and are looking for some guidance, or simply do not have the capacity to handle the SAR internally.
Many organisations struggle to handle large volumes of SAR requests, leading to backlogs and large volumes to work through.
DPAS can support the management of SAR backlogs, with years of experience handling complex SARs in health and social care, and NHS/medical organisations.
DPAS has years of experience and an in-depth knowledge of handling complex SAR requests – whether that be hand written social care files, employee grievances, or complex redundancy and HR processes. Our dedicated SAR team is ready to support you, with decades of combined experience in applying appropriate redactions and exemptions.
If you are unsure what data to search for, or where to search, DPAS can support you in performing a reasonable and proportionate search.
We’ll guide you through the eDiscovery process, and provide pragmatic advice to ensure the dataset is accurate.
DPAS has many long-term clients, where our dedicated SAR team works as an extension of your internal data protection function. If you do not have the capacity, or capability, to handle requests, DPAS can provide a fully outsourced end-to-end service.
We have refined our onboarding process to ensure we can support your organisation quickly. We can be ready to support your organisation within 24 hours. Our team will work with you to align on redaction policies, identify key priorities, and establish a working relationship that is tailored to your organisation – ensuring from the outset that we are prepared and can efficiently support you.
Our pricing model is fully transparent. You will be provided a fixed cost for each subject access request. Whether you choose to utilise all of our services, or just one stage, there will be no surprises.
Our work starts from as little as £450 (+ VAT).
Dreams contacted DPAS to assist in them in managing Subject Access Requests (SARs) ensuring they were confident that disclosures were accurate and compliant.
Our dedicated SAR team have forged a strong ongoing relationship with the Dreams team, providing SAR redaction services on an ad-hoc basis, whenever demand requires.
"
Dreams takes the security and protection of our customers’ data extremely seriously.
- DATA PRIVACY AND PROTECTION LEAD
BENEFITS
- HUMAN LED
DPAS does not rely on any AI technology to redact subject access requests – all of our work is human-led, ensuring accuracy and completeness. Each request goes through a comprehensive quality assurance process.
- RISK REDUCTION
Our comprehensive onboarding, redacting, and rigorous quality assurance processes minimise the chance of accidental disclosure. This minimises risk, providing you with the peace of mind that the request will be completed accurately, and in a timely manner.
- SCALABLE AND FLEXIBLE
At DPAS we can scale our services according to your needs. Whether that is a sudden surge in SAR requests, or a need for ongoing support – we can adjust resources accordingly.
- FAST TURNAROUND
Our dedicated SAR redaction team are experts in their field, and so are able to work at an incredibly efficient pace – often completing requests quicker than internal teams who have varying priorities.
WE WORK WITH FTSE 100s Multi-National Organisations Schools Universities Councils Local Governments Agencies NHS Trusts GP Practices Retailers Charities Multi-Academy Trusts Housing Associations Ambulance Services Insurance Companies Sporting Associations Airports Retail Companies Hospitality Businesses
frequently asked questions
Redacting a SAR involves removing or obscuring information that should not be disclosed before providing the requested information. This may include third-party personal data, legally privileged information, or other exempt information. When it comes to how to redact a SAR correctly, actions should be carefully considered and applied only where there is a lawful basis to withhold the information.
Information that may need to be redacted includes:
- Personal data relating to other individuals where disclosure is not appropriate.
- Information protected by legal professional privilege.
- Information covered by a relevant exemption under UK data protection law.
- Confidential information where disclosure would be unlawful or inappropriate.
Each redaction should be assessed on a case-by-case basis.
Organisations must normally respond to a Subject Access Request within one calendar month of receiving it. In some cases, where the request is particularly complex or numerous, the deadline can be extended by up to a further two months, provided the individual is informed within the initial one-month period.
Yes. If there is reasonable doubt about the identity of the requester, organisations may request additional information to verify identity before releasing personal data. This doesn’t always need to be a copy of ID, you may be able to satisfy yourself that the requestor is who they say they are by other means.
Only information that you are not required – or are not permitted – to disclose should be redacted. This may include third-party personal data, privileged communications, or information covered by specific exemptions. The ultimate aim is to provide the requester with as much of their personal data as possible while protecting the rights of others.
Yes. Many organisations choose to outsource all or part of the process to specialist SAR redaction services, particularly for complex or high-volume requests. However, the organisation remains responsible for ensuring the response is accurate, compliant with UK GDPR, and provided within the statutory deadline.
Yes, but only in limited circumstances. An organisation may refuse to comply with a SAR if it is manifestly unfounded or manifestly excessive, or if an exemption applies. Any decision to refuse a request should be carefully documented, and the individual must be informed of the reasons for the refusal – and their right to complain to the Information Commissioner’s Office (ICO).
You should perform a ‘reasonable and proportionate’ search. Generally speaking you should search all the systems/softwares/databases where the data is accessible. Most modern software have search functionality built in, like email providers, HR systems, shared drives etc.
Complexity is determined by a variety of factors, the ICO quotes that the following can be considered:
- Technical difficulties in retrieving the information – for example if the data is electronically archived.
- The request includes large volumes of particularly sensitive information.
- There are potential issues around disclosing information about a child to a legal guardian.
- If you have to perform any specialist work in redacting information or communicating in an accessible way.
A request is not deemed as being complex just because it involves a large amount of information. If you have particularly large amounts of data, you may wish to review retention periods, and destruction policies.
If you decide a request is complex you should always keep a record of your decision and the reasoning behind it.
Failure to respond within statutory timescales may result in complaints to the Information Commissioner’s Office (ICO) and potential regulatory scrutiny.
An outsourced DPO is an external data protection expert who takes on the legal responsibilities of a Data Protection Officer for your organisation. Instead of hiring an in-house DPO, you gain access to expert GDPR support, compliance oversight, and regulatory guidance at a fraction of the cost.
Under UK GDPR and EU GDPR, you must appoint a DPO if:
– You are a public authority or body (except courts acting in a judicial capacity).
– Your core activities involve large-scale processing of special category or criminal offence data.
– You systematically monitor individuals on a large scale
We provide an emergency response service for data breaches, cyber incidents, and regulatory concerns. You can contact us 24/7 via phone or our ticketing system, and our team will guide you through containment, impact assessment, regulatory reporting, and mitigation strategies.
You will be assigned a dedicated DPO who understands your organisation, industry, and compliance needs. However, we also provide backup cover if your DPO is unavailable, ensuring you always have a fully qualified expert at your disposal.
All of our DPOs have years of experience working in privacy. They all hold various academic qualifications and at a minimum hold BCS Practitioner Certificate in Data Protection, AI for Data Protection Practitioners CPD and have Cyber Security training from the Open University.
As your appointed Data Protection Officer, we act as the main point of contact with the Information Commissioner’s Office (ICO) and other regulatory bodies. We respond to ICO inquiries, manage audits, and handle compliance investigations on your behalf, ensuring the best possible outcome.
Our pricing is based on your organisation’s size, sector, and data protection needs. We offer flexible packages, from retainer-based support to full-service DPO solutions. Prices start from as little as £400 per month. Contact us for a tailored quote based on your requirements.
Medical and Healthcare, Education and Schools, Public Sector and Local Authorities, Financial Services, Retail and Leisure, Charities and Nonprofits and many more. All of our team have specialisms in different sectors so we will ensure you are paired with the best DPO to meet your organisation’s needs.
Contact us to discuss your organisation’s needs.
We will put together a tailored proposal together based on your organisation’s requirements and the level of support you need. You are then assigned a dedicated DPO, we will send you a contract to sign and then we can get started.
Meet Our SARs Team
zack bellekom
subject access requests manager
jemma jones
senior subject access requests officer
SOPHIE COSTAIN
subject access requests officer
bethany meredith
subject access requests officer
Yasmin barker
subject access requests officer
Mia Wreford
subject access requests officer
Katie Saxton
subject access requests officer
Jemma Gregory
subject access requests officer
DPAS have been hugely helpful in recent years, in ensuring that SWAST are doing our best and continuing to comply with information governance best practice and compliance. From our experience, every one of the team is knowledgeable and extremely competent. We have benefited from a range of services from DPAS and specifically with them acting as our Data Protection Officer. They have offered training and advice, and added to our Information Governance capacity, which was welcome and much needed.
We were looking for an independent review and audit of our data processing activities and policies across the Rhodes Trust and our partner programmes. When we went to the market, DPAS impressed us with the breadth and depth of the services they offered. We are a relatively complex organisation, but the DPAS team quickly understood how our work fits together, and throughout the audit process, I’ve appreciated the expertise of each member of the team that we’ve worked with. Their advice throughout has been reassuringly thorough, pragmatic, and tailored to our needs.
DPAS provides us with excellent, responsive advice when we need to supplement our in-house resource – a great, reliable service when we need it most.
The University of Exeter Students’ Guild were keen to ensure we were delivering our GDPR commitment on time and on track. We therefore needed a qualified Data Protection Officer to monitor our progress, provide assurance that we were on the road to compliance, and maintain the role going forward. We sourced DPAS as they were local and have 20 years of data protection experience. We are very happy with the high standards of service received, and the training provided was not only delivered professionally, but completely tailored to our business type. I highly recommend Data Privacy Advisory if you have GDPR worries or you are considering having a Data Protection Officer look after your organisation.
When faced with a complex Subject Access Request, we went out to the market to look for a provider that had the knowledge and experience to complete the data conversion and redaction on our behalf. We were impressed with the team at DPAS from the offset and entrusted them to deliver the required redacted documents within the legal timeframes. We found the team responsive and also accommodating when we needed tweaks to how the final information was presented – I wouldn’t hesitate using the team at DPAS again.
We decided to use DPAS because we felt they were a good fit for the BOXPARK brand, being a boutique data protection advisory company. Since the commencement of the project, we have received fantastic service delivered by a great team - making a highly complex project easy to digest. They hit every deadline and continue to provide us easy-to-understand data protection advice and support.
They went out of their way to support me in a short timeframe, not only to fulfil my data privacy criteria - which included more complex special category data processing - but also with trusted legal support, which - being all under one DPAS roof - was easier to access and significantly more time and cost effective.
We enlisted DPAS to help with our journey to GDPR compliance, as we didn't have the resources and skills within our team. DPAS' approach was thorough, efficient and remarkably unobtrusive from an operations perspective. Post completion of the project, we had a clearer idea of the risks and issues that attend GDPR compliance directly, and could tidy up in-house data processing to ensure we are more efficient as a business.
On top of an already demanding workload, we had a new system integration, a merger to form a new Trust, and the impact of COVID to deal with. DPAS really helped to take the pressure off by assisting with complex SARs, and DPIAs. With no idea how many SARs you may receive, having the ability to flex by using additional resources can be quite useful. Knowing I can rely on Charlotte's support with DPIAs and data sharing agreements really takes the pressure off. It's really helpful having someone that can take the time out to review requests.
Bristol Airport have worked closely with DPAS for several years, and they have been instrumental in providing their services, helping us to deliver transformative projects across our airport.
