Subject access request
Subject access request redaction, on your computer.
A SAR under UK GDPR / DPA 2018 gives the data subject a copy of their personal data — third-party information redacted, shipped within the statutory time limit. SureRedact is built for the redaction half of that workflow.
What the SAR workflow involves
- 1. Scope — Identify the data subject; agree the date range and categories with your DPO.
- 2. Gather — Mailboxes, Drive, Vault, MIS / EHR, file shares, paper — often years and systems.
- 3. Triage — Confirm include / exclude / review for each record against the scope.
- 4. Redact — Forensic redaction of third-party, restricted-category, and exempted content.
- 5. Audit + ship — Pack records + audit trail; operator and DPO sign-off; deliver within the time limit.
SureRedact is built for steps 4–5 (redaction + audit). SurePrepare addresses steps 2–3 — apply for a pilot.
Why local-first matters for SAR redaction
A SAR file is the most sensitive personal data you hold about one person. SureRedact runs entirely on your own computer — no processor relationship, no transfer mechanism, nothing extra for your DPO to assess.
AI Policy · Security overview · Why we don’t send your documents to OpenAI
Specific sectors
For UK schools, trusts, and groups →
30-day clock; safeguarding cross-cutting; additional-needs records under SAR.
Other sectors
GP practices, housing associations, NHS suppliers, and small public bodies share the same trust posture; sector pages follow as the wedge proves.
Useful tools
Forensic redaction, on your computer.
Free for PDFs, always. macOS and Windows, ready to download.