DSAR Automation: Assemble Access Requests With an AI Agent on Rails

Who this is for: DPOs and privacy analysts answering access requests across many systems. This job is one rail in the vendor-neutral AI agent rails method. Legal points were checked on 1 November 2026. Take advice on how they apply to you.

Before: the manual workflow

The manual DSAR workflow is a relay between a privacy analyst and system owners, while a legal clock runs. The analyst logs a request, confirms identity and asks each owner for an export. The analyst then reads everything for other people's data, decides what must be withheld, and writes the reply.

Errors come from three places: a forgotten system, a record belonging to someone else, and a rushed redaction. The European Data Protection Board (EDPB) expects a search of all IT systems and non-IT filing systems, using criteria that mirror how data is structured, and that search extends to processors 1.

How long do you have to answer an access request?

Access request deadlines differ by regime, and the differences change how a rail is built. The table shows the rules we opened. It is not complete: many US states have their own statutes, and sector rules such as HIPAA set their own clocks.

A deadline service computes these dates, not the model. The EDPB's examples show why. A request received on 31 August is due by 30 September, and a last day on a weekend or public holiday moves to the next working day 1. Under the CCPA rule, a timer that waits for verification gets the date wrong.

After: the job on rails, step by step

The DSAR job on rails separates collection, drafting and decision, and only drafting uses a model.

1. The request enters through a logged channel. The deadline service records the receipt date and the regimes that may apply.
2. A privacy analyst verifies identity. The agent cannot start until this is recorded, because a verified request is its only trigger.
3. The scope is frozen. The EDPB says the assessment should reflect the situation when the request was received 1. The analyst decides whether short-lived data needs a hold, so it is not erased mid-request.
4. Connectors export the records. A collection service queries each system on the system map using verified identifiers, one subject per run.
5. The agent drafts. It writes a pack index by system, gaps, third-party flags, exemptions to consider, plain explanations of codes and a draft reply.
6. Rules check the draft. Every mapped system must show a result or a named gap, and excluded fields are removed.
7. The analyst decides, records reasons and signs off. Sign-off binds to the pack hash, so a later change voids it.
8. A separate service delivers the reply, and the analyst closes the request.
9. Working copies are deleted. The ledger keeps metadata only.

The Rule of Two sets the tool scope 8. This session reads untrusted text, because emails and notes can carry instructions, and it holds private data. So it gets no state-changing tools: no send, delete or close.

What rules do and what the model does

Rules, connectors and people do most of this job, and the model drafts words around them.

Never let a model paraphrase the personal data itself. A summary can drop a field or change a meaning. Explanations sit beside the export and do not replace it.

Why can't a model decide an exemption or send the reply?

A model cannot decide an exemption because the law asks a controller to justify the decision in the concrete case.

• The burden is on you. The controller must prove a request is manifestly unfounded or excessive 2. For Art. 15(4), a general concern is not enough: the EDPB says you must show that rights or freedoms would in fact be affected 1.
• It is a balancing exercise. The EDPB describes weighing likelihood and severity, then trying to reconcile the interests 1. National restrictions under GDPR Art. 23 vary by Member State.
• A refusal has legal content. GDPR Art. 12(4) requires reasons and remedies. CCPA § 7024(e) requires a detailed explanation and disclosure of the rest 6.
• Mistakes cannot be recalled. Unauthorised disclosure falls within the GDPR's definition of a personal data breach 10.

The agent's output field is therefore "exemptions to consider", with the rule text attached. The rail has no field where a model records a decision. The rule against acting without an approval gate applies without exception.

Who verifies identity, and how much proof is proportionate?

A privacy analyst owns identity verification, and the proof should match the risk. The EDPB says requiring an identity document is disproportionate where the person is already authenticated, for example by login. It prefers a note such as "ID card was checked" to a stored copy 1. For people without an account, California describes two matched data points for categories, and three plus a signed declaration for specific pieces 6.

An automated email link is a rule, and privacy tools run such rules well. What stays out of the model's hands is judging a doubtful case from a persuasive message.

How should third-party data be handled in an access request?

Third-party data is flagged by the agent and resolved by the analyst, usually by redaction and not refusal. The EDPB says Art. 15(4) should not lead to refusing a request altogether, and that it does not apply to the Art. 15(1)(a) to (h) information 1. The Court of Justice has held that actual recipients must be named unless that is impossible or the request is manifestly unfounded or excessive (C-154/21), and that Art. 15 generally gives no right to the identity of employees acting under the controller's authority (C-579/21) 9. So the system map should hold real recipient names.

The session never queries another person's record. Records can still mention other people, so the pattern scan masks those mentions before the model reads them. The analyst sees the original.

The rail card

The rail card below fixes what the DSAR Assembler may do, and systems enforce it.

The agent stays at L2. The rail levels reserve L4 for reversible actions, and a disclosure of personal data cannot be reversed.

What the ledger shows for one run

The ledger entry for one run shows what was searched and who signed off, without personal data. This example is illustrative. Reports roll up by rail and role.

{
  "request_id": "dsar_20931",
  "received": "<date>",
  "identity_check": {"method": "account_login", "actor_ref": "usr_118"},
  "systems_searched": ["cdp", "email_platform", "crm", "support_desk"],
  "gaps": [{"system": "call_recordings", "reason": "owner has not answered"}],
  "third_party_flags": 7,
  "exemptions_to_consider": ["art_15_4"],
  "pack_hash": "3ab1...",
  "signed_off": {"actor_ref": "usr_118", "date": "<date>"},
  "model": "model-id@version"
}

Three ways it fails, and the control for each

Each failure below is common in access work, and each control sits outside the model.

Metrics that are honest

Honest DSAR metrics measure completeness and timing, not hours saved.

• Days to complete against the legal deadline, by regime.
• Missed-system rate on seeded requests, which real requests cannot reveal.
• Extension rate. The EDPB says frequent extensions may point to weak procedures 1.
• Override rate. A rate near zero may mean nobody is reading, so sample decisions.
• Audit coverage. Any run without a complete record is a defect.

How vendor tools compare

Dedicated privacy tools cover the workflow around this job, and for many teams they are the better first purchase. We read these pages on 1 November 2026. A page's silence does not prove a feature is missing.

Choose by the gap you have. If you lack a request portal, deadlines and connectors, buy a privacy tool first. If you receive few requests from few systems, fixed queries and a self-service download may be enough, provided self-service does not narrow the scope 1. A rail adds most where data is unstructured, where systems sit outside a vendor's connectors, or where personal data cannot leave your environment. This agent runs on a private model with no external model. PrivyCDP's immutable audit ledger records each AI-assisted action with the actor that authorised it. The DSAR Assembler itself is a method you would build, not a shipped feature.

Checklist

• ☐ A person verifies identity under a written, proportionate policy.
• ☐ A deadline service computes dates per regime, outside the model.
• ☐ The system map is versioned and includes processors.
• ☐ Records are exported by connectors and queries, never paraphrased by a model.
• ☐ Each mapped system returns a result or a named gap.
• ☐ Sign-off binds to the pack hash, and the signer records reasons.
• ☐ The agent has no send, delete or close tool.
• ☐ Seeded requests run before any model, prompt or tool change.

The wider function is in the compliance, privacy and security playbook, and the method is on the AI agent rails hub. To write this rail for your team, download the rail card template.