DSAR redaction service for UK organisations Subject access requests, redacted and ready to review.
Fairleaf prepares redacted disclosure packs for DPOs, HR teams, solicitors and councils. Our software proposes the redactions and builds the pack. You review every proposed redaction and make the final call.
- Example pack sent by email
- Synthetic data only
- You approve every redaction
Redaction is where subject access requests get stuck
Finding the data is only the start. Someone then has to read every email, attachment and scanned page. They have to remove other people's personal data, keep the requester's own, and record why each item was withheld.
This takes time and skilled staff. Getting it wrong is costly in both directions. Leave a third party's details in, and you have a data breach. Take too much out, and the response is incomplete.
The clock is short. The ICO's guidance says you must respond without undue delay and at the latest within one month of receiving the request. You can extend this by up to a further two months if the request is complex, or if you have received a number of requests from the same person. If you extend, you must tell the person, and explain why, within the first month.
Source: ICO, A guide to subject access.
Fairleaf helps you meet the deadline with a pack that is consistent, documented and ready for your review.
How DSAR redaction works with Fairleaf
-
Send us the documents
You gather the relevant emails, files and records from your own systems and send them to us.
-
AI-assisted redaction
Our software proposes redactions for other people's personal data, flags passages that may fall under an exemption, and builds the disclosure pack. It proposes; it does not decide.
-
Your review
You review every proposed redaction and make the final call before anything is released to the requester.
-
Client-ready pack
You receive one bookmarked disclosure pack, with a schedule of every document, an exemption log and a search record. A draft cover letter is included for you to amend and sign.
You stay responsible for the disclosure decisions. Fairleaf does not give legal advice.
A pack you can check, explain and defend
Bookmarked disclosure pack
One PDF with a cover page, contents and bookmarks, so you and the requester can find any document quickly.
Redacted documents
Each redaction is marked with a short code that matches the schedule.
Redaction schedule
One row per document: reference number, date, type, sender, recipient, page count, number of redactions and the codes used.
Exemption log
What was withheld or redacted, and on what basis, for your reviewer to check.
Search record
The sources, search terms and date range used, so you can show the search was reasonable and proportionate.
Draft cover letter
Written in your organisation's name, ready for your DPO or solicitor to amend and sign.
Redaction codes
A clear key, for example TP for third-party personal data, SC for special category data about another person, LPP for legal professional privilege, MF for management forecasting and CR for confidential references. Each code is linked to the relevant provision of the UK GDPR or the Data Protection Act 2018.
All names, emails and records shown are made up. No real personal data appears in our example pack.
Data protection
Registered with the ICO
Franck Labs Ltd, which runs Fairleaf, is registered with the Information Commissioner's Office, registration number ZC292546.
We act as your processor
You remain the controller of the data in a request. We process it only on your instructions.
A data processing agreement first
We'll agree a data processing agreement with each client before any real data is shared.
Hosting and security
Email us your questions about hosting, retention and security and we will answer in writing.
Offer subject access redaction to your clients
Fairleaf works with law firms, HR consultancies and DPO-as-a-service providers who want to offer subject access redaction to their own clients.
Your reviewer keeps control
Your team or your DPO signs off every disclosure. We prepare; you decide.
More capacity, without new hires
Take on redaction work you might otherwise turn away or pass on.
Questions about DSAR redaction
Can we outsource a subject access request?
Yes. You can ask an outside provider to handle all or part of the work, such as the redaction and the disclosure pack. Your organisation stays the controller and remains responsible for the response. The provider acts as your processor and works only on your instructions. We'll agree a data processing agreement with each client before any real data is shared.
How long do we have to respond to a subject access request?
The ICO's guidance says you must respond without undue delay and at the latest within one month of receiving the request. You can extend this by up to a further two months if the request is complex, or if you have received a number of requests from the same person. If you extend, you must tell the person, and explain why, within the first month.
What can be redacted in a subject access request?
Usually, information about other people, unless they have agreed to its disclosure or it is reasonable to disclose it without their agreement. Information covered by an exemption in the Data Protection Act 2018, such as legal professional privilege, may also be withheld. The requester's own personal data should be disclosed wherever possible. Each decision depends on the facts, and it is your organisation's call. Fairleaf does not give legal advice.
Who is responsible for responding to a DSAR?
The controller, which is the organisation that decides why and how the personal data is used. If you use Fairleaf, you stay the controller and you make every disclosure decision. We act as your processor and handle the data only on your instructions.
How does AI-assisted redaction work at Fairleaf?
Our software proposes redactions for other people's personal data, flags passages that may fall under an exemption, and builds the disclosure pack. Each proposed redaction carries a short code that matches the redaction schedule. It proposes; it does not decide. You review every proposed redaction and make the final call before anything is released to the requester.
Can Fairleaf help HR teams with employee DSARs?
Yes. Requests from current and former employees often involve large amounts of email that name colleagues, managers and clients. Fairleaf prepares a redacted disclosure pack with a schedule of every document, an exemption log and a search record, so your HR team, DPO or solicitor can review it and make the final decisions.
Do you work with solicitors and DPO service providers?
Yes. Fairleaf works with law firms, HR consultancies and DPO-as-a-service providers who want to offer subject access redaction to their own clients. Your team or your DPO signs off every disclosure. Email hello@fairleaf.co.uk to talk to us about partnering.
See a full example pack
We will email you a complete disclosure pack built from a synthetic mailbox: the redacted documents, the schedule, the exemption log and the search record. It is free and there is no obligation.
Request the example packGet the pack (opens your email app)
Please do not send us any real personal data or request material by email. We will arrange a secure route if you go ahead.