Subject Access Request Emails

[psydii]

6 minutes ago, mavhc said:

Really we should only refer to people via a UUID in case they change their name/have name conflicts

Tried floating that idea. There was some push-back.

[pete]

2 hours ago, mavhc said:

What's the point of using initials for students when it just causes more work later? Can we stop people doing that? And always using full names?

 

Yes.  We require staff to use the student's full name at least once in an email thread discussing them because unless I interact with MJ on a daily basis and can distinguish that one from all the other MJs, 50% of our staff don't have the context to realise who's being discussed. 

 

An email that states (for example) "MJ has brittle bones and if they trip over it's a serious matter needing immediate intervention by an adult/first aider" tells me nothing beyond we're failing to adequately safeguard the child by not making it clear who's being discussed.

[mikes]

23 hours ago, IT_Guru_Edu said:

In terms of Microsoft's services, Have they now not limited the eDiscovery to a basic search? I believe to obtain the level of data a SAR requires you now need an extra 'chargeable' license from Microsoft for 'Purview/Priva' ?

 

We are only on the basic education tier and only have A1 licenses but we are able to do the Purview search that involves dates, strings, etc so we can do SAR's fine - advanced AI analysis stuff is restricted for us but we can do SAR's. Though that might be an EDU specific grant because I do remember reading that you needed a higher license for Purview ?

 

And for us we use students initials all the time, even staff initials - I just assumed for staff it's a convenience thing, for students its to avoid having their names/surnames in the e-mails - certainly not to evade any SAR, I doubt that would be on anyone's mind at all - surely if they were wanting to avoid such a thing they would meet in person ?  I can't imagine saying "Hi I had student 3282-2432-1973 they would not complete their work" 

[DalekSec]

TLDR since my last post, but i'm now having to do a DSAR, to put all PSTs into a single, in the export settings at the bottom untick 'Organize data from different locations into separate folders or PSTs'

[Bankesy]

@IT_Guru_Edu

 

That was the impression I got from our Microsoft licensing partner when it came to Purview\e-discovery even though we already have A5 Security bolt-on

[browolf]

i used pff-tools to extract the pst and then made some python scripts to handle redaction. In metadata you can easily just remove from/to lines and any other email address.  The last part is the data officer has to look through the message files for any other names that need redacting and add them to file and run a word redaction script but I can probably automate that to some degree with a lookup file of names. 

 

I wrote all the instructions and files at https://github.com/browolf/Subject-Access-Requests-from-Microsoft-Copilot-365/tree/main

Edited February 7 by browolf

[JDawgg]

Hey, 

Just kicking this back up to see what people are doing. 

 

My current process which I'm happy to do is creating an eDiscovery case and exporting. 

This then outputs an items.zip for the SharePoint content and I prefer a singular PST for the Outlook export. 

 

The next process seems very clunky. I'm having to open the Outlook PST in local Outlook and sort through the data. 

Top of information store folder seems to then filter down into other folders. This looks to be folders people have created to section email data, so any emails that hit my search criteria I then seem to get a random assortment of email folders from people. 

Currently just manually moving them all to the inbox folder. 

 

Anyone know of any third party tools that I can offer to customers that'll do the heavy lifting. 

 

For my internal HR, I'll need to send them the PST and how to open it. I expect they would then like to export the emails maybe as PDFs to send to the SAR request. It would be great if there was a tool that had a API into the tenancy, you'd populate the search term and it would output in a much friendlier format/interface. 

 

Cheers all

[notalot]

On 13/03/2026 at 12:44, JDawgg said:

Hey, 

Just kicking this back up to see what people are doing. 

 

My current process which I'm happy to do is creating an eDiscovery case and exporting. 

This then outputs an items.zip for the SharePoint content and I prefer a singular PST for the Outlook export. 

 

The next process seems very clunky. I'm having to open the Outlook PST in local Outlook and sort through the data. 

Top of information store folder seems to then filter down into other folders. This looks to be folders people have created to section email data, so any emails that hit my search criteria I then seem to get a random assortment of email folders from people. 

Currently just manually moving them all to the inbox folder. 

 

Anyone know of any third party tools that I can offer to customers that'll do the heavy lifting. 

 

For my internal HR, I'll need to send them the PST and how to open it. I expect they would then like to export the emails maybe as PDFs to send to the SAR request. It would be great if there was a tool that had a API into the tenancy, you'd populate the search term and it would output in a much friendlier format/interface. 

 

Cheers all

We do a very similar process but after we export the data we use a bit of cloud software called Nalytics made by Nalanda Technology.

 

Once imported the software does an additional search with better tooling then allows staff to redact emails and files without too much work.

 

Nalytics has a large bank of names, job roles and other identifying info and does an initial redaction pass, we reduced the amount of work by about 2/3. Its still a decent task but at least it gave some support to our staff.

 

The software doesn't cost the earth either but its not an insignificant price but its well worth it in our eyes.

[itskdog]

On 13/03/2026 at 12:44, JDawgg said:

The next process seems very clunky. I'm having to open the Outlook PST in local Outlook and sort through the data. 

Top of information store folder seems to then filter down into other folders. This looks to be folders people have created to section email data, so any emails that hit my search criteria I then seem to get a random assortment of email folders from people. 

Currently just manually moving them all to the inbox folder. 

 

When we last did an SAR (we get them very rarely here, so it's not worth it to us to invest in specialist redaction software - printing single-sided, using black marker to redact, and scanning back in provides appropriate redactions that can't be reversed), we exported emails as individual MSG files rather than as a PST for this reason. It's still sorted into folders, but native File Explorer tools can easily move things around - I usually just went through folder-by-folder and printed each item ready for redaction.

 

[simpsonj]

We seem to be getting quite a few SAR requests lately, usually from an AI assisted email...

 

Is anyone using something like Smartbox.ai to handle their SAR requests? I'll take a look at Nalytics too.

[BlueSkies]

Hi,

 

Would anyone be able to give me rough prices for Nalytics and Smartbox.ai before I approach them?  What do they base their pricing on?

 

I just wanted a rough idea to see if they are completely out of our budget before I reach out to them directly!

 

Thanks

[browolf]

if you get a microsoft a5 with out video conferencing for faculty license costs around £110, you get ediscovery premium which has a more features personally i find review sets useful to see what the keyql has produced before having to export it

Microsoft Purview eDiscovery legacy solutions | Microsoft Learn

[BlueSkies]

29 minutes ago, browolf said:

if you get a microsoft a5 with out video conferencing for faculty license costs around £110, you get ediscovery premium which has a more features personally i find review sets useful to see what the keyql has produced before having to export it

Microsoft Purview eDiscovery legacy solutions | Microsoft Learn

Thanks @browolf - I will take a look.  Do the premium features include the ability to search with case sensitive keywords - as I can't seem to see how to do that with the basic version I have using the Keyword search...

[browolf]

I don't think that is an option. You could potentially do that later, depending on how you are processing the exports

[BlueSkies]

1 hour ago, browolf said:

I don't think that is an option. You could potentially do that later, depending on how you are processing the exports

I'm currently looking into some options for this in terms of a tool that will allow us to refine the search returns, deduplicate and save as pdf to then be able to perform the redactions.  I have looked at e-Redact, Nalytics and will be taking a look at Smartbox.ai and Acuity.

 

If anyone has any others I could have a look at - suggestions would be most welcome.  Thanks 🙂

[browolf]

1 hour ago, BlueSkies said:

I'm currently looking into some options for this in terms of a tool that will allow us to refine the search returns, deduplicate and save as pdf to then be able to perform the redactions.  I have looked at e-Redact, Nalytics and will be taking a look at Smartbox.ai and Acuity.

 

If anyone has any others I could have a look at - suggestions would be most welcome.  Thanks 🙂

Now you mention it ediscovery premium does deduplication. By default it's at 65% similarity but I haven't used it enough to know if it can be higher.  I vibe coded our own processing for emails but redacting documents is still a massive pita and we are looking at products to do that 



 

[BlueSkies]

39 minutes ago, browolf said:

Now you mention it ediscovery premium does deduplication. By default it's at 65% similarity but I haven't used it enough to know if it can be higher.  I vibe coded our own processing for emails but redacting documents is still a massive pita and we are looking at products to do that 



 

Thanks - that's interesting about the ediscovery premium, I shall have a look.

 

[Bankesy]

Hi all,

 

When it comes to SARs and proof of identity, what do you all generally ask for?

 

I am thinking that asking for a photo of driving licence or passport might be enough but a cautious part of me thinks, what if somebody had those stolen? So maybe a picture of the person holding their passport or driving licence is a better way.

 

Thanks

[MYK-IT]

27 minutes ago, Bankesy said:

Hi all,

 

When it comes to SARs and proof of identity, what do you all generally ask for?

 

I am thinking that asking for a photo of driving licence or passport might be enough but a cautious part of me thinks, what if somebody had those stolen? So maybe a picture of the person holding their passport or driving licence is a better way.

 

Thanks

 

 

A guide to subject access | ICO

 

Quote

Can we ask for ID?
Yes. You need to be satisfied that you know the identity of the requester (or the person the request is made on behalf of). If you are unsure, you can ask for information to verify an individual’s identity. The timescale for responding to a SAR does not begin until you have received the requested information. However, you should request ID documents promptly.

 

Getting copies of your information (SAR) | ICO

[itskdog]

26 minutes ago, Bankesy said:

Hi all,

 

When it comes to SARs and proof of identity, what do you all generally ask for?

We don't get very many, but when we last did one we verified that the email was received from the email we already had on file for the parent, the same as if they're requesting their child's password for a homework website (e.g. Mathletics, Times Tables Rock Stars, etc.)

[dmj]

1 hour ago, Bankesy said:

 

I am thinking that asking for a photo of driving licence or passport might be enough but a cautious part of me thinks, what if somebody had those stolen? So maybe a picture of the person holding their passport or driving licence is a better way.

I guess you then need to think about the systems holding that information, the retention cycles and backups if you are now holding this extra information. You wouldn't want a SAR on a SAR to reveal you've kept hold of that information after it has been used!

[msi_school]

9 minutes ago, dmj said:

I guess you then need to think about the systems holding that information, the retention cycles and backups if you are now holding this extra information. You wouldn't want a SAR on a SAR to reveal you've kept hold of that information after it has been used!

The best process here I think would be to not retain the photo, just a record that it has been seen.

[dmj]

10 minutes ago, msi_school said:

The best process here I think would be to not retain the photo, just a record that it has been seen.

And hope the admin team stick to it if its sent in electronically.... Perhaps 'in person' only would be a good method - it would also deter spurious SARs too. 

[psydii]

Yes 100% as per @dmj  and @msi_school;  if id validation is needed, ask them to come in with it, and also alert the office staff to expect them. The  front-line staff should be trained to check and cross check against data held in the  MIS, and then email confirmation (rather than the actual documents) to the DPO/responsible officer.

 

FWIW E5 (and probably e3) Purview can spot passport id's etc being emailed, though its a bit noisy if you have granularity set to detect single instances of that sort of thing.    Also the person who would be receiving the unwisely scanned documents is usually the DPO or equivalent, so ideally placed to ensure they are deleted  from the system post-haste.

 

 

[browolf]

I vibe coded a tool to redact PDFs - it's way faster than Acrobat Pro - I have converted it to an exe file so the data officer can use it. 

https://github.com/browolf/Subject-Access-Requests-from-Microsoft-Copilot-365/blob/main/PDF Redactor/pdf_redactorV3.py