Skip to main content
Automation Showroom
Possible SetupCompliance & Legal

Automate GDPR Access Requests (Art. 15)

A multi-agent system searches CRM, mailboxes, tickets and files in parallel, redacts third-party data, and the DPO signs off. Demo architecture.

Industry
Compliance / Data protection / Mid-market
Build, estimated
6–9 weeks

At a glance

It starts with
Access request arrives
The machine handles
12 of 13 steps
A person keeps
DPO sign-off
Bottom line
days, not weeksTurnaround

The problem

Real talk: nobody wants a data subject access request landing on their desk. A customer, a former employee, or a job applicant writes "please send me all the data you hold about me" — and the clock starts.

A one-month deadline, and the person's data is scattered across CRM, several mailboxes, the helpdesk, drives and backups. Someone has to search each system, gather it, redact other people's names, review, approve. Days of manual work for a task that brings in no revenue.

And the expensive part: miss something or blow the deadline and it's a breach. Access requests are the single most common complaint category at data protection authorities — in 2024 EU regulators even made the right of access the focus of a coordinated enforcement action.

This is exactly where 2026's most interesting architecture pattern comes in: a team of specialized AI agents that does the grunt work in parallel — and lets a human make the call at the end. Here's the crew.

Access requests under Art. 15 GDPR are mandatory, regardless of company size, and the deadline is hard: one month from receipt, extendable by two further months only for complex or numerous requests — and you must announce the extension within the first month.

The real problem isn't answering, it's finding: a person's data sits in CRM, mailboxes, the helpdesk, file stores, HR and backups — often under different identifiers (name, email, account number). Backups and the archive are in scope too. Done manually, that's days to weeks of searching.

Two mistakes are expensive, and both happen constantly: missing something (an incomplete response breaches the right of access) or sending someone else's data (third-party data in the response is a reportable data breach). Art. 15(4) requires you to protect others' data — but that doesn't let you refuse the request: redact, don't refuse.

And regulators are acting: in 2023 Norway fined a chain around €850,000 for failing to handle access and erasure requests on time; France's CNIL fined Free €300,000 partly over delayed access requests. At the Irish authority, access complaints were recently the single most frequent complaint by a wide margin.

The process, step by step

Scroll through. The diagram stays put and highlights the step you are on.

The workflow01 / 13
  1. 01

    Access request arrives

    Portal · email · letter

    An Art. 15 GDPR access request arrives via portal, email or letter and starts the process — including the deadline clock of one month from receipt.

  2. 02

    Verify identity & scope

    Art. 12(6) · only on doubt

    Identity is checked only where there are objectively justified doubts (Art. 12(6)) and the scope of the request is clarified — no blanket ID demand, no storing of the ID copy.

  3. 03

    Orchestrator agent

    plans & delegates the search

    The orchestrator agent derives the person's relevant identifiers (name, email, account number) and plans the parallel search.

  4. 04

    parallel

    An AND gateway launches all search agents simultaneously — keeping fulfilment fast even across many sources.

  5. 05

    CRM agent

    Customer records

    The CRM agent searches customer records, contracts and notes for all of the person's personal data.

  6. 06

    Mailbox agent

    Email history

    The mailbox agent finds the relevant email correspondence across the connected mailboxes.

  7. 07

    Ticket agent

    Helpdesk / support

    The ticket agent searches helpdesk and support systems for the person's cases.

  8. 08

    File agent

    Drives · archive · backups

    The file agent searches drives, archives and backups — the right of access applies there too; there is no "technology exemption".

  9. 09

    Redaction agent

    Redact third parties · Art. 15(4)

    The redaction agent blacks out third-party data before anything reaches the response (Art. 15(4)) — redact, don't refuse.

  10. 10

    Dossier assembly

    Copy + mandatory info · Art. 15

    The findings are assembled into an intelligible dossier: the copy of the data plus the mandatory information under Art. 15(1).

  11. 11Human decides

    DPO sign-off

    Human-in-the-loop · Art. 22

    The DPO reviews and signs off — the mandatory human oversight (Art. 22 GDPR / Art. 14 AI Act). No AI decides on disclosure alone.

  12. 12

    Encrypted dispatch

    Deadline met

    After approval, the response goes to the data subject encrypted and in a commonly used electronic format — on time.

  13. 13

    Audit log & close

    Art. 30 · ≤ 1 month

    Every step is logged in an audit-proof way (Art. 30); the deadline monitor confirms: completed within one month.

What changes

Possible setup, not a packaged product

The figures are modelled target values for a possible setup, derived from industry benchmarks and our own tests. They do not come from a customer project; real values depend on your business. We do not sell this setup as a finished product: we measure where your bottleneck is, then build with your team. For systems that require certification (e.g. HIS, gematik, DATEV-certified) we work with specialised partners.

Before vs. After

AspectBeforeAfter
Searching the systemsBefore: Manual, one system after anotherAfter: Four agents search in parallel
Turnaround timeBefore: Days to weeks of manual workAfter: Hours to days, monitored
One-month deadline (Art. 12)Before: Often missedAfter: Monitor warns early, deadline met
Third-party dataBefore: Overlooked → reportable breachAfter: Redaction agent, then DPO sign-off
CompletenessBefore: Systems or backups forgottenAfter: Defined source list, logged
Proof toward the authorityBefore: Patchy, not demonstrableAfter: Audit trail under Art. 30

Technology

Technology Stack

n8n (self-hosted)AI Agent (LangChain)Llama/Mistral (EU or local)PostgreSQLCRM/Helpdesk/Mail-APIsS3-compatible storage

Integrations

Systems this setup can connect to

n8n (self-hosted)Orchestration
Workflow engine and orchestrator agent that coordinates the search agents as sub-workflows / tools
AI Agent (LangChain)Agent framework
n8n AI Agent node: reasoning model, memory and tools — with other agents wired in as tools
Llama / Mistral (EU or local)Sovereign models
Self-hosted via Ollama or DPA-compliant EU endpoints of commercial models — no data leaving, no training
CRM / Helpdesk / MailData sources
Read access for the specialized search agents, each scoped to its own source (data minimization)
PostgreSQLAudit log
Audit-proof record of every step and the deadline monitor under Art. 30
S3-compatible storageEncrypted storage
Encrypted, temporary storage of the dossier and the dispatch evidence

Security & Compliance

What the setup takes care of

Self-hosted & EU data residency
The entire workflow runs self-hosted (n8n) with local (Llama/Mistral via Ollama) or EU-hosted models. Personal data never leaves the house or the EU.
On-demand, not a stored pool
The full dossier is assembled only to answer the request and not kept as a consolidated data pool afterwards — data minimization under Art. 5(1)(c) by design.
Human-in-the-loop & no training
The DPO signs off on every response (Art. 22 / Art. 14 AI Act), and the data passing through is never used to train models (purpose limitation, Art. 5(1)(b)).
Complete audit trail
Search, redaction, approval and dispatch are logged in an audit-proof way (Art. 30). Each agent gets only minimal, purpose-bound access to its source.

Frequently Asked Questions

Yes. The right of access applies regardless of company size — there's no SME exemption. Any organization that processes personal data must answer an access request within one month. Smaller teams in particular rarely have the resources to search every system by hand over and over — which is exactly where the agent crew pays off.
The deadline is one month from receipt, extendable by two further months for complex or numerous requests — but the extension must be announced within the first month. The workflow stamps receipt, monitors the deadline and warns early, so you either respond in time or document the extension cleanly.
A dedicated redaction agent detects and blacks out third-party data before it reaches the response (Art. 15(4)). Important: redacting isn't refusing — Recital 63 and the authorities require that the response be provided, just with third-party data redacted. The final control sits with the DPO.
No. The agents search, redact and draft — the decision to disclose is always made by a human. The DPO signs off on every response before it leaves the house. That's the mandatory human oversight under Art. 22 GDPR and Art. 14 AI Act, deliberately built as an approval gate rather than a rubber stamp.
Honest answer: yes, that is itself a sensitive, likely high-risk processing activity — a DPIA is usually required. That's exactly why the design is defensive: the dossier is assembled on demand and not retained, the models run self-hosted or on EU endpoints, the data is never used for training, and each agent has only minimal, purpose-bound access. Your DPO still sets the legal frame.
Because potentially all of a person's personal data passes through here — that doesn't belong in a black-box cloud. Self-hosted n8n plus local or EU-hosted models keep the data in-house, simplify the GDPR case and avoid lock-in. The trade-off is operational effort; our n8n-vs-Make comparison shows when it's worth it.

What would this look like at your company?

This workflow is a demo. Whether it pays off for you depends on where things get stuck at your company. The method page shows how to find out. To place a workflow of your own, use the free assessment. No call needed.

Start the assessmentHow it worksAll workflows in the showroom