Data subject access request software
Complex requests.
Clear responses.
One request can reach across thousands of emails, conversations and documents. Bring the work together, reduce repeated review, and stay in control of what you disclose.
Follow a requestUnderstand the request.
Find, assess and redact.
Prepare a considered response.
Less searching. Less repetition. More control.
Simply Discover DSAR helps privacy, legal and operational teams manage data subject access requests from scoping and collection through review, redaction and secure delivery.
Whether you are a DPO coordinating a request, a legal adviser assessing disclosure or a reviewer working through the records, the case keeps your work connected. AI assists the assessment. People see the reasoning and make the decisions.
An illustrative request
“Please send me the personal information you hold about my role and performance, including discussions about me.”
Morgan Ellis, a former employee. A fictional example of a request that goes well beyond searching one mailbox.
01 / Scope
Morgan has used a full name, a shortened name and more than one email address. Their information may also sit in someone else's mailbox, a Teams discussion or an attached document.
Keep names, email addresses and a Slack user ID together. Distinguish identifiers suitable for automatic labelling from details that only provide context, so a common first name is not treated like a unique email address.
A versioned case brief, date windows, source selections and filters carry the request's scope into collection and classification. The address used to deliver the response stays separate from the mailbox being searched.
Preview a Mimecast query and its matching message count before importing. For OneDrive and SharePoint, use a date window or all files in the selected location.
Collection depends on each source's permissions and configuration. Import progress, status and item-level failures remain visible in the case.
02 / Discover
An email does not have to be addressed to Morgan to contain their personal information. Assessment needs the content, the subject and the context of the request.
Classification considers the subject's identifiers, case brief, decision criteria and record content. Reviewers can inspect the supporting reasoning and evidence, change the decision and record their own rationale.
Whether to disclose a record and which passages to protect within it are separate decisions. Case-specific withholding reasons and extraction labels help the assessment reflect the request.
Previous classification opinions remain available. Human-authored, reviewed and overridden decisions are protected from later AI runs, with the settings used for each run recorded alongside the work.
“Morgan Ellis led the handover and completed the training plan. A separate paragraph discusses a colleague's private contact details.”
Fold duplicates and review representative records, with thread members and attachments still accessible. Include duplicates when needed. Email selection for the response considers recorded privilege decisions; chat context stays together for assessment.
Attachments have their own processing and review records, separate from the parent email. Follow background classification progress and retry items that need attention.
Search extracted categories and deduplicated values, find their occurrences and open the source. Authorised reviewers can reject false positives and curate an AI-generated subject profile line by line once classification is complete and the profile is editable.
Precision without the repetition
The same private phone number can appear in an email, a reply and a document. A deliberate redaction should not mean starting again every time.
AI highlights subject information, third-party details and potentially confidential content. Reviewers refine those highlights, add their own labels and decide what needs protection.
Apply a text redaction to a single occurrence, throughout a record or across the case. Keep local exceptions where the context calls for a different decision.
Draw box redactions in supported previews, including image and spreadsheet previews. Available tools depend on the document and preview capability.
Our approach to redactionMorgan Ellis completed the training plan and led the handover.
A colleague's private contact number is 07700 900123.
Earlier in this thread: “My private number is 07700 900123.”
Morgan Ellis handed over the project. The colleague's private number is recorded again: 07700 900123.
3 matching occurrences selected across 2 records.
Marked text is replaced in email and chat exports. Document PDF redactions are burned into the rendered pages. Inspect the export presentation before delivery, rather than relying on a highlight in a review screen.
Keep the whole team moving
When privacy, legal and IT share the work, the next person should not have to reconstruct the request.
A case graph connects the subject, sources, review sets and reviewers. Open work from that overview, resize panels or move into a full-screen review surface.
Search cases, filter by status and see due dates, days remaining and overdue requests. In review, filter by content type, decision, reviewer, date, file type or attachment status; keep useful views as saved filters.
Assign or reassign eligible reviewers, mark work done or pending, and apply bulk decisions to selected records or a filtered set. Progress and individual failures stay visible. Comments can sit on an item or a particular passage.
The case assistant can help shape the brief, propose source configurations, filters or labels, and draft a message to the subject. Proposed changes and messages come back to a person for review and approval.
Case and import permissions separate review access from officer actions such as changing decisions and generating or downloading packs. Service providers can organise client requests with customer assignments, case references and reviewer access.
03 / Disclose
Morgan's request is reviewed. Now the team's decisions need to become a response, with issues surfaced before the pack is generated and control over how it is delivered.
Readiness checks identify material marked for disclosure but not yet reviewed, a disclosable attachment whose parent is withheld, and reviewed communications missing captured content needed for export.
Blockers are distinguished from issues an officer can acknowledge. Open the affected records and revalidate against the current case state.
Generate a communications PDF or a ZIP containing communications and individual document PDFs, depending on the content. Email and chat use captured review views; documents and attachments follow their export and redaction paths.
Background generation shows progress and can be cancelled. An officer review bundle helps investigate rendering issues, with a PDF copy when available.
An authorised officer can download the pack or use integrated secure delivery. Set the recipient's recorded contact address, a cover message, link expiry and an optional download limit.
An encrypted delivery copy is shared through a recipient-specific link. Revoke future access from the pack record and retain the case's message history. Revocation cannot recall a copy already downloaded.
The work behind the response
A response is easier to explain when the scope, assessment and human judgement have stayed connected from the start.
Scope, sources, processing, review, withholding and the case timeline, including AI reasons, human changes and reviewer attribution.
The generated pack's redaction and withholding information remains available for authorised officers, separate from the subject's response.
Simply Discover is customer-hosted in Azure, AWS or on premises. Keep deployment under your organisation's control, with case and import permissions governing access.
Where the repeated work goes
The benefit is in the work you no longer have to repeat or reconnect. The time saved will depend on the request, the data and your review process.
| When work is disconnected | With Simply Discover DSAR |
|---|---|
| Rebuild the search for every source | Shared subject identifiers, a versioned brief and a deliberate collection scope |
| Track separate collection jobs | Source scope, import progress and failures visible in the case |
| Re-read repeated email chains | Duplicate folding, representative records and accessible thread context |
| Start every assessment from a blank page | AI-assisted classification with reasoning that reviewers can inspect and change |
| Redact the same detail again and again | Occurrence, record or case-wide text redaction, with local exceptions |
| Manage assignments in a separate tracker | Reviewer ownership, saved filters and bulk actions within the review workflow |
| Assemble the response by hand | Readiness checks and pack generation connected to reviewed material |
| Reconstruct why something was withheld | Recorded decisions, reviewer attribution, audit reports and a redaction register |
| Move to a separate process to send the pack | Integrated encrypted delivery with expiry, optional limits and access revocation |
DSAR software, explained
A data subject access request, often called a DSAR or SAR, is a request by a person to access their personal information. Under UK data protection law, the right of access also covers supplementary information about how their data is used. See the ICO's explanation of the right of access.
It connects the operational work of a request: defining the subject and scope, collecting relevant data, AI-assisted classification, human review, redaction, response checks, pack generation and secure delivery. A case history records the work behind the response.
Microsoft 365 mailboxes, Microsoft Teams, OneDrive, SharePoint, Gmail, Mimecast and Slack. Slack can use a configured connection or imported export data. Availability and collection scope depend on source permissions and configuration.
AI assists classification and highlights information for review. It supplies reasoning and evidence that people can inspect. Authorised reviewers can change decisions and record their own rationale; human-authored, reviewed and overridden decisions are protected from later AI runs. The organisation remains responsible for its disclosure decisions.
Yes. Text redactions can apply to one occurrence, an entire record or the whole case, with local exceptions. Supported document previews also provide box redaction. Reviewers still decide what needs protection in context and inspect the export presentation.
Attachments have their own processing and review records. The response can be a communications PDF or a ZIP with communications and individual document PDFs, depending on its content. Marked email and chat text is replaced in the export; document PDF redactions are burned into rendered pages. Readiness checks run before pack generation.
Yes. Authorised officers can use integrated secure delivery with an encrypted delivery copy, recipient-specific link, expiry and optional download limit. Future link access can be revoked from the pack record. A downloaded copy cannot be recalled. Authorised officer download is also available.
Yes. Simply Discover supports customer-hosted deployment in Azure, AWS or on premises. Source connections, access permissions and configuration need to be planned for your environment.
No. Software supports the process; it does not replace your organisation's assessment of the request, applicable law, deadlines, exemptions or disclosure obligations. Simply Discover provides review controls, visible reasoning, response checks and case records to support that work.
Simply Discover DSAR
Bring a typical request, the sources it reaches and the review decisions that take your team time. Start the conversation with the work that matters to you.
