A Subject Access Request (SAR) forces the institution to disclose all personal data they hold on you, including internal investigation notes, case handler comments, decision records, and correspondence you were never meant to see.
When you upload the SAR response, the system runs a forensic analysis across every page. This isn't a summary; it's a detailed extraction of everything that undermines the institution's position and strengthens yours.
Why SARs matter for CIFAS challenges
Institutions' internal records frequently contradict their public position. A SAR can reveal:
- The real basis for the marker: internal notes often show the marker was filed on suspicion alone, without the clear, relevant and rigorous evidence that CIFAS Principle 4 requires
- What they knew and when: records may show they were aware of facts that undermine their position (for example, that you reported the transactions as unauthorised before they filed the marker)
- Procedural shortcuts: missing risk assessments, investigations conducted without proper authority, decisions made before evidence was reviewed
- What they told CIFAS vs what they told you: the filing justification submitted to CIFAS may differ from the reasoning in their complaint response
Once these contradictions are in your letters, they're extremely difficult for the institution to defend.
How the upload step appears
An upload step for the SAR response appears in your roadmap in two situations:
- When a standalone SAR letter is sent: the system generates a dedicated SAR letter, and an upload step is created to receive the response.
- When a SAR demand is included in another letter: the system may weave a SAR demand into a complaint or counter response. When it does, the upload step is created automatically alongside the normal response upload step. You may not realise a SAR was included until the upload step appears.
You don't decide whether to send a standalone SAR or embed it in another letter. The system makes this decision based on your case strategy. Both result in the same upload step and the same forensic analysis.
How to upload
When the SAR response arrives, open the upload step in your roadmap. SAR responses can be large: sometimes hundreds of pages of bank statements, investigation notes, and internal correspondence. The system handles this.
- Upload one or multiple files: PDF, Word, Excel, or images. If the response came as multiple documents, upload each one.
- Large files are supported: the system handles large uploads efficiently, even for SAR responses with hundreds of pages of transaction data.
If the institution sent the SAR response by email, download the attachments and upload them to your case.
Password-protected files
Institutions frequently send SAR responses as password-protected PDFs or encrypted ZIP files. The system handles this:
- Automatic unlock: the system attempts to decrypt the file automatically.
- Password step: if it can't unlock the file, a separate "Enter password" step is created in your roadmap. Enter the password the institution provided and the system decrypts and proceeds.
- Both PDF and ZIP encryption: supported for both file types.
What the forensic analysis extracts
The system reads every page and extracts:
- Contradictions: where the institution's internal records say one thing but their public response says another. Each contradiction is captured with the specific claim, the contradicting internal record, and the significance for your case.
- Procedural failures: where they didn't follow proper process, mapped to the specific regulation they violated.
- Investigation notes: case handler comments, team discussions, and decision rationale, with dates and authors.
- Internal communications: email chains, memos, and internal correspondence about your case.
- Evidence they relied on: what they claimed to base their decision on, how strong it actually is, and how to challenge it.
- Timeline reconstruction: a chronological sequence of events built from their own records.
- Supporting evidence: anything in their records that helps your case, even if they didn't intend it to.
- Critical omissions: material information that should be in the file but isn't: missing Suspicious Activity Reports, absent risk assessments, no record of the decision to file the marker.
- Red flags: concerns in their records and how to handle them.
- Letter ammunition: exact quotes from their records, ready to be deployed in your next letter.
The analysis handles large SAR responses efficiently. Repetitive content like transaction statements is processed intelligently so the forensic analysis focuses on the material that matters: investigation notes, decision records, and internal correspondence.
Analysis runs in the background
DSAR forensic analysis is the most intensive analysis the system performs. After you upload:
- You see a confirmation: the upload is acknowledged immediately
- Analysis runs in the background: you can close the app and come back later
- You're notified when it's done: by email and in-app notification
- Your roadmap updates automatically: new steps appear based on the findings
What happens after analysis
Once the forensic analysis completes, the system updates your roadmap:
- If material contradictions or procedural failures are found: a clarification step is created asking you to confirm key findings before they're used in letters
- A counter response step is always created: the system builds your next letter from the forensic findings, deploying the contradictions, failures, and exact quotes against the institution
- Your case intelligence is refreshed: the full case analysis is updated with the DSAR findings, which then feed into every future letter
How findings feed into your letters
Everything the forensic analysis finds is used directly in future letters:
- Contradictions are quoted: your counter response cites their internal record alongside their public claim, forcing them to explain the discrepancy
- Procedural failures become GDPR breaches: each failure is mapped to a specific regulation and added to your breach log
- Exact quotes are deployed: the system extracts specific phrases from their internal records that undermine their position and weaves them into your arguments
- Omissions are challenged: if material information is missing from the SAR response, the system demands it, citing DPA 2018 exemption requirements
- Their own words become your strongest argument: if an internal note says "no evidence of deliberate dishonesty", that's cited directly
Incomplete or redacted SAR responses
If the institution sends a partial or redacted response, upload it. The system analyses what was provided and identifies what's missing:
- Unjustified redactions: if they've redacted information without citing a valid exemption, the system challenges it
- Missing time periods: if the response doesn't cover the relevant dates, the system demands the remainder
- Referenced but not provided: if documents are mentioned in their records but not included, the system identifies and demands them
An incomplete SAR response is itself a regulatory failure. The system uses it as additional evidence of non-compliance.
What if they don't respond to the SAR?
Institutions are legally required to respond within one month under UK GDPR Article 15. If they don't:
- The deadline breach is recorded automatically: this is a GDPR Article 15 violation, added to your breach log
- A chaser step is created: demanding compliance with the statutory timeframe
- The breach is cited in escalation letters: non-compliance with SAR obligations strengthens your ICO complaint and FOS referral
Ignoring a SAR is one of the strongest indicators that the institution has something to hide. The system uses this strategically.
The SAR forensic analysis is one of the most powerful capabilities in the system. Once the institution's own internal records contradict their public position, their case becomes extremely difficult to defend.
