Strategic Scoping Reduces DSAR Review and Protects Sensitive Data

A banking client was served a DSAR by a former employee whose contract had been terminated on grounds of redundancy. The request was extremely vague, broadly seeking disclosure of all information mentioning the individual's name — including confidential business activities and information unrelated to the redundancy decision.

The client faced three core issues:

• The scope of the request was overly broad and lacked specificity.
• There was a risk of inefficient review and unnecessary disclosure of sensitive business information.
• The client needed to ensure compliance with GDPR and relevant legal precedent while maintaining cost efficiency.

Early Case Assessment

Morae's project management team conducted an initial scoping exercise to define entitlement boundaries under GDPR and case law. This assessment clarified that the data subject was not entitled to all documents mentioning their name, but only those relevant to personal data and the redundancy decision.

Workflow Design

Leveraging years of DSAR experience, Morae guided the client in developing a targeted review workflow. This approach prioritized documents containing personal data and excluded irrelevant or confidential business information, avoiding an inefficient "review everything" strategy.

Standardization for Future Requests

Morae assisted the client in creating a standardized DSAR response framework. This included clear communication templates to inform future data subjects of the limitations of DSAR disclosures, ensuring transparency and reducing ambiguity in subsequent requests.

Technology Enablement

Advanced filtering and analytics tools were deployed to streamline document identification and reduce review volume. Morae's technology-driven approach ensured accuracy, speed, and compliance throughout the process.

Morae significantly reduced the review population, delivering a cost-effective and timely solution. The client achieved full compliance with GDPR and legal precedent while avoiding unnecessary disclosure of sensitive business information. The standardized response framework also positioned the client for efficient handling of future DSARs.