DSAR AI Redaction GDPR

ChatGPT or Copilot for a DSAR? What to Check, and Where a Dedicated DSAR Tool Fits

Can you use ChatGPT or Copilot to answer a subject access request? What a DSAR needs, what to check in any AI tool, and where a dedicated DSAR tool fits.

October 14, 2026 • 7 min read

Short answer

A general AI assistant such as ChatGPT or Microsoft Copilot can help with parts of a subject access request, for example drafting a plain-English cover letter. It is not built to run the request: tracking the one-month deadline, recording how you verified the requester, producing a redacted copy of every file and keeping a record of what you disclosed and why. If you want to upload real documents to one, check the plan’s terms first. A dedicated DSAR tool is designed around those steps, which is why it is usually the safer choice.

What does a DSAR actually need?

Under Article 15 of the GDPR, the requester is entitled to confirmation that you process their data, a copy of it, and information about the processing. Article 12(3) gives you one month from receipt, extendable in some cases. Article 15(4) says the copy must not adversely affect the rights and freedoms of others.

In practice, a DSAR needs:

  • A lawful basis, and a contract with any provider that processes the documents for you. Article 28 requires one, usually called a data processing agreement (DPA).
  • A known data location. If personal data goes outside the EEA, Chapter V of the GDPR requires a transfer mechanism, such as an adequacy decision or standard contractual clauses.
  • Deadline tracking from the date the request was received.
  • Identity checks where you have reasonable doubts about who is asking (Article 12(6)).
  • Consistent redaction of other people’s data across many emails and attachments.
  • Output files with the text actually removed, not just covered with a black box.
  • A review step by a person before anything is released.
  • A record of what you disclosed, what you withheld and why. The Irish Data Protection Commission (DPC) says exemptions should be documented, for example in a table, and that organisations must be able to explain them (DPC Annual Report 2024).
  • Secure delivery. The DPC’s guide for controllers says the controller is responsible for transmitting personal data securely.

What should you check before using a general AI assistant?

Start with the terms of the exact product and plan you use. Whether inputs are used for training, where data is processed, and whether a DPA is in place differ by product and plan. Check your own AI use policy as well.

Then think about what you would be uploading. A DSAR file is often about more than one person: it can hold colleagues’ names, other customers’ details and sometimes health information. Uploading it to any online service is processing that needs a lawful basis and appropriate security (Article 32).

Two more points are easy to miss:

  • Prompts can become records. Microsoft says Exchange Online stores Microsoft 365 Copilot and Copilot Chat activity, including user prompts and Copilot responses, in mailboxes that eDiscovery can search (Microsoft Learn). What you type about a requester may become more data you hold about them.
  • A summary is not a copy. The Court of Justice of the EU has held that the copy must be a faithful and intelligible reproduction of all the personal data (CJEU press release, Case C-487/21). The EDPB says a compilation of the data must not alter or change the content (Guidelines 01/2022, para. 152). An AI rewrite of someone’s emails risks doing exactly that.

Where can a general assistant still help?

Used without personal data, an assistant can help you draft a template letter or explain a GDPR article in plain language. Check what it produces against the primary sources: AI can produce confident text that is wrong.

What does a dedicated DSAR tool do differently?

A dedicated tool is built around the steps above. This is how SAR Portal handles them:

  • Deadlines. The due date is one calendar month from the date received. Each case shows its due date and the days left, and the dashboard lists cases that are due soon or overdue. The Extend Deadline action allows up to two further months, records it on the case with the reason you give and, if the case has an email address, emails the requester.
  • Identity. For requests made through your public portal, a one-time code confirms the requester controls the email address they gave, and SAR Portal records that as the verification method.
  • Redaction with review. AI suggests what to redact. In the upload flow you review the suggestions and choose what to redact before anything is applied. AI can miss personal data or redact too much, so always check the result before you release it. Detected items start selected, including the requester’s own details: use “Deselect Subject Data” to keep the requester’s own information in their copy.
  • Text that is really removed. Word and PowerPoint files keep their layout, with the text removed. In Excel, the whole cell is replaced. Redacted PDF pages become images, and pages without redactions stay searchable.
  • A record. Every action is recorded in an audit log. No user can edit or delete entries.
  • Delivery. Requesters who submit through your public portal download their response from the portal.
  • Data location. Case data and documents are stored in Microsoft Azure West Europe (Netherlands), with a second copy of documents in North Europe (Ireland). AI processing runs in Azure Sweden Central. A few supporting services work outside the EU under Standard Contractual Clauses or the EU-US Data Privacy Framework: Microsoft Graph (your users’ names and emails, for invitations), Google reCAPTCHA (browser signals from people using your request forms) and Stripe (billing). None of them receive case content or documents.
  • What the AI services keep. Azure OpenAI does not use your data to train models. Microsoft’s abuse monitoring may store prompts and responses its systems flag, in the EU, for review by authorised Microsoft staff in the EEA. Azure AI Language does not store the input text for PII detection, and Document Intelligence deletes the document and results 24 hours after analysis.
  • A contract. Our Data Processing Agreement lists our sub-processors. See also our security page and Trust Center.
  • Sign-in. Single sign-on (SSO) via Microsoft & Google: your users sign in with their existing Microsoft 365 or Google account. A one-time email code is also available.

Is using ChatGPT or Copilot for a DSAR illegal?

No tool is illegal in itself. The GDPR regulates what you do with personal data, not which software you use. A general assistant can be used lawfully for some tasks, with the right terms in place. The risk lies in what it is not built to do: track the deadline, record identity checks, keep a disclosure record and produce redacted files. For contentious requests, take advice from your DPO or a solicitor.

Frequently asked questions

Can I use ChatGPT or Copilot to answer a DSAR? Yes, for some tasks, such as drafting a cover letter that contains no personal data. Before you upload real documents, check the plan’s terms: whether inputs are used for training, where data is processed and whether a data processing agreement is in place differ by product and plan.

Is it lawful to upload DSAR documents to an AI chatbot? No law bans a particular tool. The documents usually hold personal data about the requester and other people, so you need a lawful basis, an Article 28 contract where the provider acts as your processor, appropriate security and, if data leaves the EEA, a valid transfer mechanism.

Can an AI summary replace the copy of personal data? No. The Court of Justice of the EU has said the copy must be a faithful and intelligible reproduction of the personal data, and the EDPB says a compilation must not alter the content. A rewritten summary risks changing it.

How does SAR Portal use AI? AI suggests what to redact. In the upload flow you review the suggestions and choose what to redact before anything is applied. The AI services run in Azure Sweden Central, and Azure OpenAI does not use your data to train models.

Related guides:

Use a tool built for DSARs. Every free trial gives you Pro features for 14 days. No credit card required. Start a free trial or book a demo.

Sources

Ready to simplify your DSAR process?

SAR Portal helps you handle DSARs with AI-suggested redaction, deadline tracking and an audit trail.

Related Articles