Human Review and Approval - You Stay in Control of Exactly What Gets Disclosed
Automation should speed up a DSAR, not decide what leaves the building. Obtainer puts a human in the loop at the end, so DSAR review and approval is where a person redacts, checks, and signs off, and you stay in control of exactly what gets disclosed.
found
scanned
Assembling the cover letter from the template...
Helps you comply, not legal advice
In short
DSAR review and approval is the human-in-the-loop step where a person checks a drafted data subject access response, redacts what should be withheld, and approves it before it is disclosed. Obtainer is built so this gate is never skipped: discovery and drafting are assisted, but nothing is released automatically, and every response waits at a review gate until a human redacts third-party and exempt data and approves it. This is the honesty wedge at the core of the product, you stay in control of what is disclosed, because the release decision belongs to a person, not the tool. Obtainer helps you comply. It is not legal advice, so the judgments about exemptions, scope, and what is releasable stay with your team. It is self-serve DSAR fulfillment from $34/mo, and the review gate is standard, not an enterprise add-on inside a six-figure suite.
What you get
Human review, built for privacy, legal, and ops teams
Nothing releases on its own
Discovery and drafting are assisted, but a response is disclosed only after a person approves it, so the tool never sends on its own.
You control what is disclosed
A human redacts and signs off at the gate, so you decide exactly what the requester sees.
Judgment stays with your team
Obtainer surfaces and drafts, but exemptions and scope are your team's call, because it helps you comply and is not legal advice.
A gate, not an add-on
Human review and approval is standard in the workflow at every tier, from $34/mo, not a feature locked behind an enterprise tier.
How it works
From an intake request to a ready-to-review response in four steps
Assemble the response
Discovery and drafting produce the manifest and the drafted response for your team to review.
Redact at the gate
A reviewer masks third-party and exempt data, so only what belongs is left in the response.
Approve or hold
A human approves the disclosure or holds it for changes. Nothing moves without that sign-off.
Disclose on your terms
The approved response ships. You stay in control of what is disclosed. Obtainer helps you comply. It is not legal advice.
Reference
What a reviewer must hold back before a DSAR response is released
The review gate exists because a compiled DSAR almost always contains something that must not go to the requester. California spells part of this out by name: its regulations list data a business may never disclose in response to a request to know, even to the person it belongs to. The rest comes from the rights of other people and from exemptions your counsel applies item by item.
| Found in the compiled data | The rule | What the reviewer does |
|---|---|---|
| Social Security number, driver's license or other government ID number, financial account number, health insurance or medical ID number | CCPA regulations, 11 CCR 7024(d): never disclose in response to a request to know | Withhold the value and tell the requester, with enough detail, that this type of data was collected |
| Account password, security questions and answers | 11 CCR 7024(d), same prohibition | Withhold and state the category |
| Unique biometric data, such as a fingerprint scan | 11 CCR 7024(d); the regulation's own example is to say a fingerprint scan is collected without disclosing the scan | Describe the data, never release it |
| Other people's personal data, such as colleagues in email threads or other customers in a ticket | GDPR Article 15(4): the copy must not adversely affect the rights and freedoms of others | Redact, or disclose only where consent or a documented balancing supports it |
| Legally privileged advice or data under a specific exemption | Exemptions apply to specific items, never to the whole request | Withhold the item with a recorded reason; your counsel makes the call |
| The requester's own ordinary data | In scope | Approve for release |
Frequently asked
Questions teams ask about human review
Should DSAR responses be reviewed before disclosure?
Yes. A person should check every response before it is disclosed, because a DSAR often contains third-party data and material you are entitled to withhold, and releasing the wrong thing is its own breach. A human review gate lets someone redact, verify scope, and approve the disclosure. Obtainer never releases a response automatically, so this step is never skipped.
What is human-in-the-loop review in a DSAR?
Human-in-the-loop review means software handles the mechanical work, discovery, manifest assembly, and drafting, but a person makes the release decision. The drafted response waits at a review gate where a reviewer masks third-party and exempt data and approves it. It keeps you in control of exactly what is disclosed, rather than trusting a tool to decide.
Who approves a DSAR response?
A person on your privacy, legal, or operations team approves it, not the software. Obtainer assembles and drafts the response, then holds it at a review gate until a reviewer redacts what should stay back and signs off. The release decision belongs to your team, because the judgment about exemptions and scope is a legal call, not a mechanical one.
Can DSAR fulfillment be fully automated?
The repetitive parts can, intake, verification, discovery, drafting, and deadline tracking, but the release decision should not be. Fully automating disclosure risks sending third-party or exempt data to the requester with no one checking. The sound model keeps a human in the loop for redaction and approval, so speed comes from automation and control stays with your team.
Run a data subject access request end to end
Obtainer finds where a person's data lives across your systems, compiles it into one manifest, drafts the deadline-safe response, and tracks the GDPR and CCPA clock. You review, redact, and approve what gets disclosed. Helps you comply; not legal advice.