Yunseon Hong · RedactCheck
I’m asking people how subject access requests actually get redacted.
I’m a developer, not a privacy professional, and I haven’t built anything yet. Before I do, I want to hear from people who do this work how they handle it today.
Who is writing to you
My name is Yunseon Hong. I build document-processing software: systems that take files in, read what’s inside them, and move them along without a person opening every one by hand.
What I am not is a privacy professional. I’ve never handled a DSAR, I don’t hold a CIPP/E, and everything I know about Article 15(4) UK GDPR and DPA 2018 Schedule 2, Part 3 comes from reading them, not from applying them with a deadline running and a requester waiting. In any conversation about this work you are the one with the expertise. I’d rather write that down now than let you find it out three minutes into a reply.
How I ended up looking at this
What got my attention was a job advert. A London not-for-profit was hiring a Subject Access Request Officer on a three to six month contract, £130 to £145 a day, and the duties listed redaction alongside the rest of it. Someone is being paid a day rate to read through pages and decide what gets blacked out.
That made me curious rather than confident. Work repetitive enough to hire a contractor for is often work software can take a piece of. It can also be the kind of judgement that software makes worse, and from the outside I genuinely cannot tell which this is. I’ve never had to justify a redaction to the person who asked for the file.
So the sensible next step was to ask first and build later, if at all.
What exists today
Nothing. There’s no beta, no waiting list on this page, and no demo I’m angling to put in front of you. I have notes and a rough idea, and I’m holding off on writing the code until I’ve heard enough to know whether any of it survives contact with the actual job.
There is a page describing what I have in mind, and you’re welcome to read it. What it describes is an intention. Nothing on it runs yet.
I do plan to sell something eventually. You should hear that from me, not work it out later.
If this research turns into a tool, I’ll charge for it. I work on my own and this is meant to pay for itself one day. Saying otherwise would be a lie with a short shelf life.
What I can’t tell you is what the tool would be, because that’s the part I’m still trying to work out. So there’s nothing for me to sell you today, and this isn’t a pitch wearing a research costume. If something paid does appear later and you’d rather not go near it, your answers will still have been useful and I’ll still send you what I promised below.
What I’m asking for
- One reply, in your own words. Two or three lines is a real answer. If you write more, I’ll read all of it.
- How the work actually goes, including the parts that are held together with a highlighter and a second pair of eyes.
What I’m not doing
- Email only, never a call. I work in writing, so there’s no calendar link on this page and nothing to book. It keeps the ask small on both sides.
- Reply to the email, or write to the address below. That’s the whole mechanism. There’s no form to fill in and no survey behind a link.
- Your address stays in my mailbox. It goes on no list, and nothing else gets sent to you off the back of it.
One question, answered whenever it suits you
How do you handle redaction or masking at the moment?
That’s the only thing I’m asking. A paid tool, Acrobat, a printer and a marker pen, a colleague who is better at it than you are: whatever the honest answer is, that’s the one I want to hear.
Before you decide whether to bother
- Reply whenever. Three weeks from now is as useful to me as today. There’s no window closing.
- Name your organisation only if you want to. “A mid-sized housing association” or “a law firm, about forty people” tells me everything I need.
- Nothing gets published with your name on it. Anything I write up is aggregated and stripped of identifying detail, and I don’t quote anyone without asking first.
- Silence is a complete answer. There’s no sequence behind that first email: one short follow-up at most, and then I stop writing.
In return, I’ll put together a short write-up of how people are handling this work: which tools, which workarounds, which parts everyone finds slow. Names and organisations taken out, and it goes to everyone who answered. You’ll get it whether or not anything ends up being built. It costs me nothing to send, and I suspect you’re as curious as I am about how the rest of the field does this.