Automate GDPR Access Requests: the Multi-Agent Crew (Art. 15)
Answer Art. 15 GDPR data subject access requests in days, not weeks: a multi-agent system searches CRM, mailboxes, tickets and files in parallel, auto-redacts third-party data, and the DPO signs off. Self-hosted, deadline-safe, auditable.
Real talk: nobody wants a data subject access request landing on their desk. A customer, a former employee, or a job applicant writes "please send me all the data you hold about me" — and the clock starts.
A one-month deadline, and the person's data is scattered across CRM, several mailboxes, the helpdesk, drives and backups. Someone has to search each system, gather it, redact other people's names, review, approve. Days of manual work for a task that brings in no revenue.
And the expensive part: miss something or blow the deadline and it's a breach. Access requests are the single most common complaint category at data protection authorities — in 2024 EU regulators even made the right of access the focus of a coordinated enforcement action.
This is exactly where 2026's most interesting architecture pattern comes in: a team of specialized AI agents that does the grunt work in parallel — and lets a human make the call at the end. Here's the crew.
The DSAR crew as a workflow
An access request triggers the run: the orchestrator delegates the search to four parallel agents, a redaction agent blacks out third-party data, the DPO signs off — only then does the response go out on time.
Before vs. After
| Aspekt | Before | After |
|---|---|---|
| Searching the systems | Manual, one system after another | Four agents search in parallel |
| Turnaround time | Days to weeks of manual work | Hours to days, monitored |
| One-month deadline (Art. 12) | Often missed | Monitor warns early, deadline met |
| Third-party data | Overlooked → reportable breach | Redaction agent, then DPO sign-off |
| Completeness | Systems or backups forgotten | Defined source list, logged |
| Proof toward the authority | Patchy, not demonstrable | Audit trail under Art. 30 |
The Challenge
Access requests under Art. 15 GDPR are mandatory, regardless of company size, and the deadline is hard: one month from receipt, extendable by two further months only for complex or numerous requests — and you must announce the extension within the first month.
The real problem isn't answering, it's finding: a person's data sits in CRM, mailboxes, the helpdesk, file stores, HR and backups — often under different identifiers (name, email, account number). Backups and the archive are in scope too. Done manually, that's days to weeks of searching.
Two mistakes are expensive, and both happen constantly: missing something (an incomplete response breaches the right of access) or sending someone else's data (third-party data in the response is a reportable data breach). Art. 15(4) requires you to protect others' data — but that doesn't let you refuse the request: redact, don't refuse.
And regulators are acting: in 2023 Norway fined a chain around €850,000 for failing to handle access and erasure requests on time; France's CNIL fined Free €300,000 partly over delayed access requests. At the Irish authority, access complaints were recently the single most frequent complaint by a wide margin.
Our Solution
At the center sits an orchestrator agent in a self-hosted n8n workflow: it derives the person's relevant identifiers from the request and launches four specialized search agents in parallel — one each for CRM, mailboxes, helpdesk tickets, and files/backups. Each agent knows only its own source and returns the personal data it finds. This is the multi-agent pattern Gartner named a top trend for 2026 — applied to a process every EU company must perform.
Then a redaction agent takes over, blacking out third-party data before anything reaches the response (Art. 15(4)). The findings are assembled into an intelligible dossier — the copy of the data plus the mandatory information under Art. 15(1). Then the most important step: the DPO signs off. No AI decides on disclosure alone — human oversight is mandatory (Art. 22 GDPR, Art. 14 AI Act). Only after approval does the response go out encrypted and on time, with every step logged in an audit-proof way (Art. 30).
An honest caveat: a system that pulls together all of a person's data is itself a sensitive, likely high-risk processing activity — a DPIA is usually required. That's why the dossier is assembled on demand and not retained as a consolidated store, the models run self-hosted or on EU endpoints, the data is never used for training, and each agent has only minimal, purpose-bound access. The cockpit doesn't replace legal advice — it makes fulfilment fast, complete, and demonstrable.
Key Features
Orchestrator + specialized agents
An orchestrator agent plans the search and delegates it to specialized sub-agents (n8n AI Agent / LangChain). The multi-agent pattern Gartner named a top trend for 2026 — applied to a real, mandatory process.
Parallel search across all sources
CRM, mailbox, ticket and file agents search every system at once — including archive and backups, which are also in scope for the right of access. Fulfilment stays fast even with many sources.
Automatic third-party redaction
A redaction agent detects and blacks out other people's data before it reaches the response (Art. 15(4)) — redact, don't refuse, as Recital 63 and the authorities require.
DPO sign-off before dispatch
The finished response doesn't go out automatically; it enters an approval queue. The DPO decides — mandatory human oversight under Art. 22 GDPR and Art. 14 AI Act.
Self-hosted & EU-sovereign
Models run self-hosted (Llama/Mistral via Ollama) or on DPA-compliant EU endpoints. Sensitive data never leaves the house and is never used for training.
Audit trail & deadline monitor
Every step — search, redaction, approval, dispatch — is logged in an audit-proof way (Art. 30). A monitor tracks the one-month deadline and warns early when an extension is needed.
Results
Possible setup, not a packaged product
The figures shown are target values and expected magnitudes for a possible setup – based on industry benchmarks, public studies of comparable setups, and our own tests on a real stack. They are not measured outcomes from a specific customer project; actual results depend on company size, process maturity, and integration depth. We do not offer this setup as a packaged product. We help teams design, automate, and run such processes themselves – through architecture consulting, workshops, and implementation support with n8n. For regulated third-party systems with certification or license requirements (e.g. HIS, gematik, DATEV-certified), we partner with specialized providers.
Access requests answered deadline-safe in days instead of weeks — parallel search across all systems, automatic redaction of third-party data, DPO sign-off, and a complete audit trail
Integrations
Seamless connection to your existing infrastructure
n8n (self-hosted)
OrchestrationWorkflow engine and orchestrator agent that coordinates the search agents as sub-workflows / tools
AI Agent (LangChain)
Agent frameworkn8n AI Agent node: reasoning model, memory and tools — with other agents wired in as tools
Llama / Mistral (EU or local)
Sovereign modelsSelf-hosted via Ollama or DPA-compliant EU endpoints of commercial models — no data leaving, no training
CRM / Helpdesk / Mail
Data sourcesRead access for the specialized search agents, each scoped to its own source (data minimization)
PostgreSQL
Audit logAudit-proof record of every step and the deadline monitor under Art. 30
S3-compatible storage
Encrypted storageEncrypted, temporary storage of the dossier and the dispatch evidence
Security & Compliance
Enterprise-ready with highest security standards
Self-hosted & EU data residency
The entire workflow runs self-hosted (n8n) with local (Llama/Mistral via Ollama) or EU-hosted models. Personal data never leaves the house or the EU.
On-demand, not a stored pool
The full dossier is assembled only to answer the request and not kept as a consolidated data pool afterwards — data minimization under Art. 5(1)(c) by design.
Human-in-the-loop & no training
The DPO signs off on every response (Art. 22 / Art. 14 AI Act), and the data passing through is never used to train models (purpose limitation, Art. 5(1)(b)).
Complete audit trail
Search, redaction, approval and dispatch are logged in an audit-proof way (Art. 30). Each agent gets only minimal, purpose-bound access to its source.
Technology Stack
Frequently Asked Questions
Related Showcases
EU AI Act Compliance Cockpit – Prove Your Obligations, Automatically
Automate the EU AI Act and GDPR obligations themselves: a central AI registry, an immutable audit trail, a human-in-the-loop gate for automated decisions, and automatic Article 50 transparency notices. Deadline-safe instead of a spreadsheet.
Internal Knowledge AI: GDPR-Compliant RAG Assistant (On-Premise)
Build an internal knowledge AI without data leakage — a RAG chatbot answers team questions from Confluence, Jira and Git repos, fully on-premise, with source citations and permission checks instead of hallucinations.