Case study

DSAR Case Study: Three Weeks to Five Days

Industry Pulse: Education

Exam Scripts, Exam Marks and Subject Access

How to access a request

How to Respond to a Subject Access Request: UK Guide

DSAR in Schools - breakdown

Subject Access Requests in Schools: An Overview

Version History and Deleted Files in DSAR Searches

A complete DSAR search should consider relevant document versions and, where appropriate, deleted data to ensure personal information is not overlooked.

OneDrive and SharePoint: Common DSAR Mistakes

OneDrive and SharePoint can contain large amounts of personal data across shared folders, sites and documents. This article highlights common DSAR mistakes, including incomplete searches, duplicate files and missed third-party information, and explains why thorough discovery and review are essential for an effective DSAR response.

Finding Personal Data Across Microsoft Teams Chats

Microsoft Teams chats can contain valuable personal data that organisations must consider when handling DSARs. This article explores the challenges of locating personal information across Teams conversations and the importance of systematic discovery, review and redaction to support effective DSAR compliance.

Retrieving Personal Data from AI Knowledge Bases.

AI knowledge bases can contain personal information from multiple business systems, creating new challenges when organisations need to respond to a DSAR. Finding, reviewing and appropriately redacting this information requires a clear understanding of how AI systems store and access data.

Who Owns AI-Generated Personal Information?

AI-generated information about individuals creates new challenges for privacy and DSAR compliance. While individuals may not technically "own" AI-generated outputs, they may still have rights over personal data and inferences relating to them. Organisations should therefore ensure their AI systems, data governance and DSAR processes work together to provide appropriate transparency, access and accountability under the UK GDPR.

How Generative AI Creates New Personal Data Challenges

Generative AI can create new personal data challenges by producing additional records from information provided by users. Organizations need to consider AI prompts, outputs, conversation histories, and stored information when responding to DSARs. Careful review and redaction of third-party information can help protect privacy while ensuring organizations meet their data protection obligations.