When a subject access request arrives that is bigger than the team can handle, the usual next step is to look for an outside DSAR service. This page sets out what those services do, how they are priced, what your organisation keeps responsibility for whichever route you take, and what handling the request in-house with redaction software involves.
What an Outsourced DSAR Service Does
DSAR response services are offered by data protection consultancies, law firms and document review providers. A full service usually covers the whole request:
- logging the request and tracking the deadline
- checking the requester's identity
- collecting the personal data from your systems
- reviewing every document for the requester's data and for other people's
- redacting third-party information and anything exempt
- drafting the response letter and the disclosure pack
Some providers will also take on a single stage, such as the review and redaction, while your own team handles the rest.
How Outsourced DSARs Are Priced
Providers generally quote each request individually, because the cost depends on how many documents the search returns and how much legal judgement the review needs.
Osborne Clarke publishes one of the more detailed price lists, in its DSAR management flyer dated September 2026. It prices first-level review at £1,500 a day, at an estimated rate of about 300 one-to-two-page documents a day, and charges £2,750 to load a data set of up to 20GB onto its review platform. Its two worked examples come to an estimated £10,100 and £14,500, excluding VAT. Both figures include second-level review by its lawyers and a response letter, so they pay for legal judgement as well as document handling.
What Stays With Your Organisation Either Way
Whichever route you choose, your organisation remains the controller and is responsible for the response under UK GDPR.
- The deadline. You have one month to respond, usually counted from the day you receive the request. It can be extended by up to two further months for complex or numerous requests if you tell the requester within the first month (Article 12(3)).
- The scope of the search. You must make a reasonable and proportionate search for the requester's personal data (Article 15(1A), added by the Data (Use and Access) Act 2025). A provider can run the search, and deciding its scope is still your call. Our guide to reasonable and proportionate searches covers what the standard means.
- The contract. A provider that handles the personal data is your processor, and you need a written contract with it that meets Article 28.
- The decisions. What is disclosed, withheld or redacted goes out in your name. If the requester complains to you or to the ICO, you answer for it. Our guide to the section 164A complaints procedure explains the route a requester now has.
Where the Hours Go
In a large request, most of the time goes on review. Every document the search returns has to be read for the requester's data and for other people's, and each piece of third-party information has to be weighed against the requester's right of access before it is disclosed or redacted. At about 300 short documents per reviewer-day, the rate in Osborne Clarke's flyer, 10,000 documents comes to more than 30 reviewer-days.
This review and redaction stage is the part software can take on. Our guide to DSAR redaction covers the ICO balancing test, what to remove and what to keep.
How SafeRedact Fits
SafeRedact is browser-based redaction software for data subject access requests. Files never leave your browser: documents are processed client-side, only extracted text and the case's data subject details are sent for AI detection, and no documents are stored on servers. Detection text is never used for training and is deleted within 30 days. You name the data subject whose information should be preserved, and other individuals' personal information is flagged for redaction across every file in the case, including ZIP and Purview PST exports. Every detection is reviewed by a human before anything is exported, and the export package includes the redacted files, a processing summary, an audit trail and a review decision log. Supported formats: PST, PDF, DOCX, XLSX, EML, MSG, HTML, TXT, CSV, JSON, ZIP. A Data Processing Agreement is accepted on screen at set-up, and enterprise cases are priced per case by document count, with the price shown at set-up.
SafeRedact does not respond to the request for you. Your team runs the case, makes each redaction decision and sends the response, so the search, the judgement calls and the letter stay in your hands.
What a Case Costs
A request for one person is one case, priced by the number of documents in it. These are the prices for organisations registered in the UK:
| Documents in the case | Standard route | UK and EU route |
|---|---|---|
| Up to 2,500 | £495 | £594 |
| Up to 10,000 | £995 | £1,194 |
| Up to 25,000 | £3,085 | £3,700 |
Prices exclude VAT. The UK and EU route keeps detection on AWS infrastructure within the UK and EU. Each document carries an allowance of 100,000 characters of text, so a very large document counts for more than one, and a case above 25,000 documents is priced in writing. Euro and dollar prices are on the pricing page.
You can evaluate first on up to 500 of your own documents for 14 days, with the full review, and pay only when you download. Your first case is refunded in full within 14 days of export if you ask.
Choosing a Route
| Outsourced DSAR service | In-house with SafeRedact | |
|---|---|---|
| Who reviews the documents | The provider's reviewers, with sign-off arrangements that vary by provider | Your team |
| Where the documents are processed | Varies by provider | On your own computer, with only extracted text and the data subject details sent for detection |
| Advice on exemptions | Varies by provider | Not included; your team or your counsel decides |
| Contract | A processor contract with the provider (Article 28) | A data processing agreement accepted on screen at set-up |
| Price | Varies by provider | Published case price by document count |
| Who sends the response | The provider or your team, as agreed | Your team |
What an outsourced service includes, where it does the work and how it charges all differ from one provider to the next, so check the terms of any provider you are considering.
Frequently Asked Questions
Can we outsource a subject access request?
Yes. You can engage a provider to handle all or part of a request. The provider acts as your processor under a written contract that meets Article 28 UK GDPR, and your organisation stays responsible for the response as controller.
How much does an outsourced DSAR service cost?
Providers generally quote each request individually, based on the number of documents and how complex the review is. Osborne Clarke's DSAR management flyer of September 2026, one of the few published price lists, gives worked examples of £10,100 and £14,500 excluding VAT, including review by its lawyers and a response letter.
Does SafeRedact respond to the request for us?
No. SafeRedact is software your team runs. It flags other people's personal information across the documents in the case and records each decision your team makes. Your team decides what to disclose and sends the response.
How long do we have to respond to a DSAR?
One month, usually counted from the day you receive the request. You can extend it by up to two further months where requests are complex or numerous, as long as you tell the requester within the first month and give your reasons (Article 12(3) UK GDPR).
When does software make sense instead of a service?
Software makes sense when the volume of documents is the bottleneck and your team can make the redaction decisions itself. A service makes more sense when you also need someone to run the search, advise on exemptions or write the response.
Make Every Redaction Decision Once
AI detection flags every identifier in the case. You decide whose it is, with the requester's data preserved and every decision recorded in the exported audit trail. Cases are priced per case, with a Data Processing Agreement available.
Set up your organisationRelated Guides
Third-party prices are quoted from the provider's published material on the date shown and may change. SafeRedact is not affiliated with Osborne Clarke. This page is informational, not legal advice. The legislation, regulator guidance, and your counsel govern how the rules apply to your organisation.