Automating data subject access requests
For companies with lots of customer data across several systems that receive requests regularly and compile them by hand every time.
Updated: 2026-11
We build a process that lets your company answer access, rectification and erasure requests under the Swiss FADP and the GDPR on time and traceably: intake channel, identity check, a map of where personal data lives, automated queries via interfaces, response templates and a log per request. Legal assessment of individual cases stays with you or your law firm.
An access request is quickly made and laborious to answer when personal data sits in CRM, accounting, support tool, newsletter system and email archive. Without an overview every request becomes a search, and the deadline runs.
Incomplete or late answers are among the most common triggers of complaints. At the same time information may only go to the entitled person; disclosure to someone else is itself a data breach.
What you get
Data map
Which systems hold which personal data, with query options.
Process and roles
From intake to answer, with deadline monitoring and deputies.
Identity verification
A proportionate method, neither lax nor off-putting.
Automated queries
Where interfaces exist, data is compiled automatically.
Templates and log
Response templates and evidence per request for supervisory queries.
How it runs
- 01
Assess
Record systems, data flows and past requests.
- 02
Process
Define process, roles and templates, align with data protection.
- 03
Automate
Implement and test queries via interfaces.
- 04
Roll out
Train those involved and run a test request.
Price framing
Effort depends on the number and openness of systems. Process and templates work without automation; automation follows where it pays off.
Indicative, not a binding quote — the frame is confirmed during scoping.
What drives the price? → Cost guide
Parent service: Data Protection Consulting
FAQ
Within what deadline must I answer?
Under Swiss law generally within 30 days, under the GDPR within one month, extendable in justified cases. The process monitors the deadline automatically.
Do we need an expensive platform?
Not necessarily. With few systems a clean process with templates is enough. Specialised tools pay off at high volume.
Do you check what must be disclosed?
We implement the process. Legal assessment of individual cases, such as restrictions on the right of access, stays with you or your law firm.
Does it cover erasure requests?
Yes. The same process covers rectification, erasure and objection, taking statutory retention duties into account.
Automating data subject access requests
For companies with lots of customer data across several systems that receive requests regularly and compile them by hand every time.