> ## Documentation Index
> Fetch the complete documentation index at: https://signalschools.co.uk/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Subject Access Requests

> Handle GDPR subject access requests with AI-assisted redaction and automated data packaging.

## What are subject access requests?

Under the General Data Protection Regulation (GDPR), individuals have the right to request a copy of all personal data held about them. Schools must respond to these requests within **30 days**.

Signal's Subject Access Request (SAR) feature automates what would otherwise be a labour-intensive manual process.

<Note>
  This feature requires the DSL or Owner role.
</Note>

## How it works

Signal guides you through a 4-step process to collect, redact, and export the requested data.

<Frame>
  <img src="https://mintcdn.com/signalschools-02f5aab3/74rxIAkm743C2GEk/more-features/sar-interface.png?fit=max&auto=format&n=74rxIAkm743C2GEk&q=85&s=9d78c38c701679c6f3fbc6de71b336b2" alt="New Subject Access Request wizard showing the four steps: Subject, Contacts, AI Redacting, and Review & Edit" width="1440" height="900" data-path="more-features/sar-interface.png" />
</Frame>

<Steps>
  <Step title="Select subject">
    Go to **Settings > SAR** and start a new request. Select the individual the request relates to — either a student or a staff member.
  </Step>

  <Step title="Select contacts">
    Choose which contacts to include in the request. This step applies to student SARs only — it is skipped for staff SARs.
  </Step>

  <Step title="AI Redacting">
    Signal's AI identifies and suggests redactions of sensitive third-party information — such as other children's names, staff details, or confidential case notes from other individuals. Suggested redactions are highlighted for your review.
  </Step>

  <Step title="Review & Edit">
    Review the collected data and approve or modify the AI-suggested redactions. You can accept, adjust, or reject individual redactions to ensure the package is complete and compliant. When you are satisfied, export the final redacted data package ready to send to the requester.
  </Step>
</Steps>

<Warning>
  Completed SARs are automatically deleted after **7 days**. Make sure you download and save the exported package before it is removed.
</Warning>

## What is included?

A SAR data package typically includes:

* All incidents where the individual is named
* Documents attached to the individual's profile
* Comments and communications mentioning the individual
* Activity and access logs
* Any other personal data held within Signal

## Important considerations

<Warning>
  Subject access requests have a strict **30-day response deadline**. Start processing requests as soon as they are received.
</Warning>

* **AI redaction is a suggestion** — always review redactions carefully before exporting
* **Third-party data** must be redacted to protect other individuals' privacy
* **Exemptions may apply** — some data may be exempt from disclosure (consult your data protection officer)
* Keep a record of all SARs processed for compliance purposes