In a recent drop-in session, we rolled up our sleeves and got into the detail of Data Subject Access Requests, especially the parts that tend to raise eyebrows or cause headache – exemptions.
Together with the excellent team at Smartbox.ai, we explored what these exemptions actually mean in real scenarios, how to handle third-party data with care, and what counts as reasonable when it comes to disclosure or redaction.
So, what are exemptions exactly?
They’re specific carve-outs under the UK GDPR and Data Protection Act 2018 that allow organisations to limit what they disclose in a DSAR response. These aren’t shortcuts. They need to be applied thoughtfully, with a clear understanding of the legal basis and a solid paper trail behind each decision. This is where strong policy and confident handling really matter.
A few key areas to focus on
- Third-party data
You’ll often be weighing the rights of the data subject against the privacy of others. It’s a balancing act that sometimes requires consent, sometimes doesn’t. In some cases, redacting the data entirely is the safest approach. - Legal privilege
If legal advice is involved or litigation is a factor, you may well be able to rely on this exemption, but it has to be applied carefully. - Confidential references
Typically exempt, but best practice is to make that clear in your policies up front to avoid confusion or conflict down the line.
We also covered practical redaction tips, how to make decisions consistently, and where technology can make a huge difference in accuracy and speed…
→ Enter Smartbox.ai
Let’s be honest, DSARs handled manually can be a real drain on time and resources. Smartbox.ai showed us how their platform helps by automating key steps like identifying personal data, deduplication, collaborative redactions and tracking decisions. Their tool doesn’t just save time. It strengthens compliance by giving you full visibility and an audit trail throughout the process.
If you’ve been managing DSARs with spreadsheets and highlighters, this is the kind of upgrade that could save you hours and reduce the chance of costly mistakes.
What’s next?
We’re running regular drop-ins with expert guests and real-world insight from our work with clients across the country. If you’re dealing with DSAR challenges or want to explore tools that actually make your life easier, keep an eye on our LinkedIn or drop us a line. Or, just fancy a quick chat about how your current process stacks up? We’d love to hear from you at info@evolvenorth.com or call us on 01748 905 002