Join CDS’ Mark Anderson in this two-part blog series as we journey through current DSAR landscape and evaluate how generative AI is changing how corporations and law firms are handling these cases, gaining efficiencies and reducing cost by harnessing the power of technology.
A DSAR Explosion
Data Subject Access Requests (DSARs) are not a new concept. First established in the 1984 Data Protection Act, DSARs have been a consistent feature throughout the evolution of UK data protection law, appearing again in the 1998 Act and later expanding across the EU as part of the General Data Protection Regulation (GDPR) in 2018.
In my 15 years in the eDiscovery industry, I’ve watched DSARs evolve from a niche, something that might occur once or twice a year, to a major area of activity. We routinely see months with 30 or more DSARs across our client base, with some organisations managing up to 15 DSARs a month individually.
Why the Growth?
There are a number of key factors behind this surge, most importantly:
- Increased public awareness following GDPR’s introduction.
- Simplified request processes, making it easier for individuals to submit DSARs.
- Tactical use of DSARs by consumers and employees in legal disputes and grievances.
As a result, DSARs have transformed from a compliance obligation into a powerful legal and strategic tool for individuals.
The Expanding Data Challenge
The volume and complexity of DSARs have also grown dramatically. While email remains the most voluminous data source, organisations now rely heavily on collaboration tools such as Microsoft Teams and Slack, both of which are rapidly becoming the largest repositories of personal data.
For clients using Slack, this can be particularly burdensome due to the platform’s limited filtering capabilities, often resulting in hundreds of thousands (or even millions) of messages requiring review. These platforms require specialised tools such as CDS Convert to handle this complex data, and reduce the cost of what can often be extremely large data sets.
Beyond messaging platforms, personal data relevant to a DSAR may also reside in:
- WhatsApp chats
- Jira tickets
- Zendesk records
- Handwritten notes
- Audio and video recordings
Each of these introduces unique challenges for identification, extraction, and redaction, increasing both time and cost pressures on organisations.
What Does This Mean for Businesses?
The business impact of DSARs varies widely. Some organisations may rarely encounter them, while others face large volumes of requests, either consistently or following major events such as redundancies, where multiple employees simultaneously exercise their data rights.
For some, it’s not the frequency but the scale that creates difficulty: a handful of exceptionally large DSARs with limited response timelines.
Last month, I joined HelloDPO’s Alison Deighton and Claire Saunders for the webinar “A Route to DSAR Success: Best Practice Insights and AI Innovations.” During our discussion, Alison emphasised the importance of acting early, defining scope, and refining keywords, explaining that organisations should aim to, “start with your narrowest possible data set, which is often still huge.”
For many clients, especially in the public sector or charity space, this workload creates a severe strain on already limited staffing and budgets. Legal or HR professionals often work late hours to meet deadlines, while larger organisations that outsource DSAR processing can face significant external costs, with some clients reporting bills of £70,000 – £90,000, and in one instance reaching £130,000 for a single DSAR.
This not only introduces financial pressure but also leads to burnout and stress among internal teams.
How AI Is Lifting This Burden
Generative AI is reshaping how organisations approach DSARs, cutting costs, accelerating response times, and improving accuracy.
The most significant impact we’ve observed comes from using AI to automate first-level document review using Relativity aiR for Review. By analysing vast datasets, AI removes much of the manual effort previously required for initial review and filtering.
Using Relativity aiR up to 3 million documents can be analyzed per day, identifying materials relevant to the defined criteria. It provides full transparency, including:
- The rationale behind each decision
- Considerations for potential false positives
- Citations showing where relevant content appears within a document
At CDS, we now deploy Relativity aiR for the majority of DSARs, transforming what was once a week-long process into less than an hour for the initial review. Join us in part 2 of this series in January 2026 as we dive deeper into some real world cases showing how AI is reducing this burden for our clients, reducing time, cost and freeing up internal resources.
