Due to the tight timelines required for response, capacity issues across several multidisciplinary teams, the volume of responsive data retrieved, and the sensitivity of a number ofspecific Data Subject Access Requests (“DSARs”) Indeed found itself at a crossroads. The need to effectively and efficiently address DSARs processing was paramount, compounded by the challenge of having offices in jurisdictions across the EU, where data sets included varying levels of non-English languages.

The internal technical solution relied upon for DSARs was proving not fit for purpose, bogging down relevant teams with its time-consuming processes. The risks were non-negligible, with unredacted data at risk of being mistakenly produced to data subjects, exposing sensitive information.

Data sets in question included sensitive categories of personal information, some of which fell under GDPR exemptions. This included documents containing personally identifiable information of third parties and legally privileged material, elevating the stakes of each DSAR handling.