Subject access requests
Answer the request. Then prove you answered it properly.
Find everything in scope, redact third-party information consistently, and show your search was reasonable and proportionate — with the reason for every redaction on record.
What the obligation asks
A subject access request gives a person the right to a copy of their personal data (UK GDPR Article 15). You have one calendar month to respond, extendable by up to two further months for complex or numerous requests. The Data (Use and Access) Act 2025 confirms that the search must be reasonable and proportionate, and lets the clock stop while you wait for information you reasonably need, such as clarification of the request. Information about other people can be withheld where the Data Protection Act 2018 allows (Schedule 2, paragraph 16).
Where it goes wrong
- Officers apply exemptions differently, so similar requests get different answers.
- Third-party information is missed, or redacted so heavily the response is useless.
- Nobody can show afterwards why the search stopped where it did, and requesters can now complain to you directly.
How Smartbox handles it
Different regimes. The same four steps.
- 01
Discover
Collect from mailboxes, file shares and case systems; remove duplicates and thread email; record every source searched.
- 02
Decide
Reviewers apply exemptions from a library you control; third-party information is flagged for a decision; every mark carries its basis and reviewer.
- 03
Act
Redactions are burned into the response copy and checked before release.
- 04
Prove
The record shows what was searched, what was withheld and why, and when and why the clock stopped.
What you can show afterwards
- Exemptions recorded, not remembered.
- Clocks that hold their own evidence.
- Redactions in the file itself.
Questions
Does Smartbox decide what to redact?
No. It finds and proposes; your reviewers decide, and each decision is recorded with its reason.Can we show our search was reasonable and proportionate?
Yes. The record shows which sources were searched and what was found, alongside the reasons your team records for limiting a search.How is third-party information handled?
It is flagged for a decision, and each decision is recorded with its basis and the reviewer's name.
Start now. Go live on Gen 2.
Choosing and approving a disclosure platform takes time. Start the conversation now, and plan your move around general availability in January 2027.