# GDPR subject access requests

> When a subject access request covers a shared record, redact the other people in it before you send the response.

Canonical: https://bitbanger.in/use-cases/gdpr-dsar
Last updated: 2026-10-27

A DSAR obliges you to give the requester their own data, not everyone else's. Support threads, call notes, and case files routinely contain third-party names, emails, and phone numbers that must come out before the response goes back.

## What this gives you

- Redact names and contact details belonging to third parties while leaving the requester's own content readable.
- Works on the concatenated export most DSAR tools produce, including email chains.
- The entity list in the response gives you a record of what was withheld and why.
- Irreversible output means the redacted response cannot be un-redacted by the recipient.

## Request

```bash
curl -X POST https://api.bitbanger.in/v1/redact \
  -H "X-API-Key: rdct_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"text": "Case note: requester called about the complaint raised by Mark Ellison, mark.ellison@example.com, on 3 October."}'
```

## FAQ

**Can I keep the requester's own details visible?**

Yes. Run the redaction first, then restore the specific spans you are required to disclose, or process the third-party sections separately.

**Is the output reversible?**

No. Replaced, masked, and removed spans cannot be recovered from the response.

## Related

- [All 40 entity types](https://bitbanger.in/entities/)
- [Integrations](https://bitbanger.in/integrations/)
- [API reference](https://bitbanger.in/docs)

Live demo: https://bitbanger.in/use-cases/gdpr-dsar