Redact SARs, audit files and investigation bundles without uploading a single file

The access request is where redaction goes wrong

A subject access request gives a person the right to a copy of their own personal data, but you have to remove everyone else’s personal data, and anything exempt, before you send it. Get that wrong and the response itself becomes a personal data breach. The ICO’s guidance on disclosing documents to the public securely is built around exactly this risk: hidden or inadequately removed personal information that causes an accidental breach.

It is not a rare problem. Subject access is consistently one of the most-complained-about areas to the ICO, and the regulator has issued reprimands to organisations that missed the deadline or mishandled a request. The right of access is a high-volume obligation that has to be met correctly, not just quickly.

One month, and the clock does not stop for volume

Under Article 12 of the UK GDPR you have one calendar month from receipt to respond, extendable by a further two months only where the request is genuinely complex. The deadline does not flex because the bundle is large or full of third-party data to redact. That time pressure is what makes consistent, fast detection matter.

What to redact in a SAR

Third-party personal data. Names, contact details and identifiers of anyone other than the requester. A person can be identifiable without their name, so watch for job titles in small teams and specific dates that point to one individual.

Confidential references and sources. Information that would identify someone who provided a reference or raised a concern in confidence.

Exempt material. Legally privileged advice, management forecasting and other content that falls within a recognised exemption, applied narrowly and documented.

Redact without uploading, keep the audit trail

RedactProof detects 60+ types of personal data on your device, you confirm and redact, and it keeps a log of what was removed for your own records. The requester’s bundle never leaves your browser, so you are not uploading personal data to a third-party service in order to protect it.

Three places to go from here. The SAR redaction software page covers features, plans and pricing. The SAR, DSAR and FOI redaction guide walks through deadlines, exemptions and the third-party balancing test. And if your caseload is audit reports, regulator filings and internal investigations rather than access requests, read redacting audit reports and investigation files.

Disclosure and litigation raise the same redaction problem with court-specific requirements. If your work crosses into that, see our redaction page for legal teams.