Nalytics SARs & Thorntons

Background and Need

Leading Scottish law firm Thorntons, has implemented Nalytics SAR’s to effectively manage their responses to Data Subject Access Requests

Thorntons Law is one of the largest Scottish full service legal and property firms. Established 150 years ago, they now have a network of offices across Dundee, Edinburgh, Glasgow, Angus, Fife and Perth, with 57 partners supported by over 450 colleagues across 11 locations.

Thorntons recognised the digital data challenge and appointed a new Director of Data Protection Services, the first role of its kind at the firm – says Morgan O’Neill:

Businesses operate in a digital economy fuelled by personal data. The spotlight has fallen on data protection recently with the introduction of new GDPR guidelines and high-profile enforcement actions taken by the ICO, resulting in significant financial penalties and reputational damage for the parties involved. Individuals are increasingly aware of their rights under Data Protection Law and the requirements of data controllers and data processors to protect the data they share with them.

A major consequence of GDPR and this new awareness is the proliferation of Data Subject Access Requests being experienced by organisations, with individuals having the right of access to what personal data of theirs is being held within organisations and how it is being used. Upon receipt of such requests, businesses must comply within one-to-three months at no charge.

Thorntons has experience both of SARs within the business and of responding to such requests on behalf of their clients, which gives them valuable insight in to the pressures involved.

Says IT Director Sarah Blair:

An individual’s personal data can exist in many forms across a diverse IT landscape. This makes it an enormous challenge to surface those records, check their validity, redact surrounding sensitive material and issue a response back to the Subject within the designated timeframe. It is a resource intensive activity that isn’t core business.” Thorntons has a long-standing reputation as a thought-leader in the pursuit and adoption of new technologies to support the legal sector. Sarah Blair continues:

 

Burgeoning volumes of unstructured big-data potentially containing personal information means that it is essential to deploy technology to help sift through our digital landscape and unearth only the relevant information to process the SAR. We embarked on a collaboration with local company Nalanda Technology using their Nalytics search and discovery platform, to help bring a focused SARs solution to market.

Solution and Result

This new SARs technology platform allows Thorntons to enter the SAR details, bringing back all pertinent mentions from the dataset, then provides a redaction and validation environment, before zipping up the final set of records for distribution back to the Requestor.

Sarah adds-

Having the entire SAR process incorporated in one easy-to-use, wizard-driven platform dramatically speeds up the response process and reduces our associated resource investment, plus we have the confidence of knowing that we are finding all of the relevant records. Overall this gives us the best chance of fulfilling our GDPR SAR compliance obligations.