Control, not just speed.

A subject access request is a request about a person, not about a set of documents. The question every reviewer has to answer is whether a piece of information is the requester's personal data, someone else's, or both. Document-level tools cannot help with that question because they do not know who anyone is.

Person resolution links every mention across the case, whether a full name, an initial, an email address, an employee number or a phone number, into one record per person. Confident links are automatic and evidenced. Ambiguous ones are queued for a decision. The result is a review organised by person: everything about the requester, and everything about each third party, in one place.

It also catches the mistakes that cause complaints: two people with the same surname treated as one, or one person under four names treated as four.

Every decision in a SAR will, sooner or later, be asked to justify itself. The requester may complain. The ICO may ask. A court may order disclosure of the process. The question is always the same: where did this come from, and why did you decide that?

Provenance means every finding points to its source: the file, the message, the attachment, the page, the paragraph and the exact span. It means every decision carries the reviewer, the time and the reason. It means the original is kept beside the extracted text so the chain can be checked.

With provenance, answering the question takes seconds. Without it, answering the question means doing the work again, and hoping the answer is the same.

Redactics does not decide what to disclose. It collects, extracts, classifies, links and suggests, and it records what it did. A named person decides, and the decision is recorded with a reason.

This is a design principle, not a limitation. Disclosure decisions involve judgement about reasonableness, harm and the rights of other people. They belong with the controller, and the controller has to be able to explain them. A system that made those decisions would not remove the accountability; it would make it harder to discharge.

The practical effect is that the searching and sorting, which is most of the time, is done by the platform, and the judgement, which is most of the risk, is done by people with the evidence in front of them.

Many tools can highlight names, dates and email addresses in a document. That is useful for a single file and unhelpful for a case. It tells you that a string appears on page 12. It does not tell you who it refers to, whether the same person appears on page 40 under a different name, or whether the sentence is about the requester, a colleague or both.

A case-level model treats the whole collection as one body of evidence. People are resolved across documents. Findings are classified with context. Third-party material is grouped. Decisions are made once per finding and applied consistently wherever it appears.

That is the difference between a redaction tool and a SAR processing platform, and it is why Redactics is described as personal data discovery rather than redaction.