Every month more of your customers know their rights. Subject Access Requests, erasure under Article 17, portability under Article 20, objection-to-processing. UK GDPR gives you one calendar month to respond. The ICO publishes the businesses that miss the window.

Most companies handle these manually. A request lands in legal@ or privacy@, a human chases it across CRM, Stripe, Mailchimp, support tickets, internal docs, exported logs. Each request burns 4-12 hours of paid time and risks blowing the deadline.

This service builds you the engine that handles it end to end. Intake, identity verification, data assembly and audit-ready exports, productionised for the business side.

UK GDPR fines run up to £17.5m or 4% of global turnover, and the ICO publishes enforcement actions by name

The one-month clock starts the second the request lands

Reputational damage from public complaints, which the ICO publishes

Audit gap: if you cannot prove every step of fulfilment, you failed the request even if you did the work

Cost-per-request scaling linearly with request volume, while volume keeps growing year over year

Consumer awareness of GDPR rights climbs every year. The curve is not flat.

A typical SAR handled manually: £400-£1,200 in fully loaded staff time depending on stack complexity.

Through the engine: roughly £5 in compute per request plus a few minutes of human review and approval.

At 10 requests/month you break even in the first quarter. At 30+, the engine pays for itself in weeks.

**Week 1:** data mapping. We catalogue every system holding personal data, every retention policy, every legal basis. The agent needs to know where to look and what to return.

**Week 2:** pipeline build. Public intake form, identity verification, request routing, automated queries across your systems, structured export, redaction of third-party data, full audit log per step.

**Week 3:** live run. We process real test requests end to end, validate exports against ICO Article 15 guidance, tune escalation rules, hand over.

The full engine: source code, infrastructure, credentials, owned by you

Public-facing intake form branded to your business

Identity verification flow (document + liveness check)

Automated routing across all systems holding personal data

Structured export for SAR, execution + proof for erasure, machine-readable export for portability

Full audit trail per request: every step timestamped and attributable

Statutory deadline tracking with auto-escalation 5 days before the window closes

Audit-ready documentation pack matching ICO guidance Article 15 §1-2

If you have a Data Protection Officer, we set the engine to route exports for their review and sign-off before they go to the requester. If you do not have one yet, we can recommend designating one (separate engagement).

After handover, an optional £397/month retainer keeps the agent current with ICO guidance updates, new data-system integrations as you add tooling, and edge cases.

Legal review of your privacy policy

DPIA authoring (separate engagement if needed)

Marketing-consent management platform (different problem, different tool)

UK or EU businesses holding personal data on more than a few thousand individuals: SaaS, e-commerce, fintech, recruitment, healthtech. If you are already getting more than two requests a month, payback is immediate. If you are not yet, you will be soon, and the cheapest time to build this is before the volume hits.