ProvePrivacy has released a significant update to its DSAR and FOI software. The ProvePrivacy platform update adds a complete Disclosure workflow, a case Timeline, wider Freedom of Information request types and clearer control of redaction budgets. Each change reduces manual effort on a request and adds to the record showing what was done and why.
The release also introduces ProvePrivacy Lite, a focused edition of our DSAR and FOI software for teams whose most pressing need is data subject rights and FOI case management. Every addition in this update is available on both ProvePrivacy Lite and the full ProvePrivacy platform. The sections below explain what each addition does and how it helps data protection and information governance teams.
What is new in the ProvePrivacy platform update?
ProvePrivacy platform release v11.1.0, published on 5 November 2026, adds a Disclosure tab to every rights and information request, covering collation, scoping, redaction, exemptions, results and secure delivery. It also adds a Timeline tab, new FOI request types, fee and public interest delay management, a redaction report, monthly credit distribution and client branded emails.
The six headline additions are:
- Disclosure tab: one workspace that takes a request from collected documents to secure delivery
- Collation and scoping: all documentation identified, duplicates removed and volume reduced before review
- Redaction improvements: files compressed into a single file, with sessions that can be saved and restarted
- Exemptions and results: exemption reasons added to the audit log, with input, output and audit files collated together
- Secure data subject portal: delivery through a time limited download portal that closes access once delivery is confirmed
- Wider FOI support: FOI (Scotland), EIR (Scotland), CHAIRs (Housing) and non regulatory requests, plus fee and public interest delay management
Smaller improvements include system generated investigation notes, a redesigned Circumstances tab, clearer incident stage information in case tables, better target date tracking, improved internal and external incident reporting forms, and Clients as a data subject type in the RoPA module. You can read the full list on the ProvePrivacy platform release notes. For earlier updates, see ProvePrivacy Platform 10.1 and the new DPIA module.
What is the Disclosure tab and how does it work?
The Disclosure tab is a workspace on each data subject rights and information request that manages the redaction process from start to finish. It keeps every document, decision and delivery step in one case record, instead of spreading them across inboxes, shared drives and spreadsheets.
Teams work through the tab in this order:
- Collation: gather all documentation for the request so every item can be clearly identified.
- Scoping: deduplicate files and apply filtering to reduce the volume for review.
- Redaction: protect third party personal data and exempt material with the built in redaction tool.
- Exemptions: record the reason for each exemption from redaction.
- Results: collate input, output and audit files into one set.
- Secure portal: deliver the response to the data subject and close access once delivery is confirmed.
Discovery, which is the search of email and business systems for relevant data, still happens in your own systems. The Disclosure tab picks up from what your team has gathered. From that point, the record builds as the work happens rather than being reconstructed at the end.
| Task | Spreadsheets and email | ProvePrivacy platform Disclosure tab |
|---|---|---|
| Identifying request documents | Tracked by hand across folders | Collation brings documentation together so it can be clearly identified |
| Reducing review volume | Duplicate threads and files read repeatedly | Scoping deduplicates files and applies filtering |
| Redaction | Page by page, often across separate tools | Built in redaction tool with saved sessions |
| Recording exemption reasons | Notes held in separate documents | Reasons added to the incident audit log |
| Keeping the record | Assembled once the request is finished | Input, output and audit files collated as results |
| Delivering the response | Attachments sent by ordinary email | Secure, time limited download portal |
How do collation and scoping reduce the volume of data to review?
Scoping is the stage that reduces gathered material to a reviewable volume before anyone reads or redacts it. In the ProvePrivacy platform, collation first brings all request documentation together so it can be clearly identified. Scoping then dethreads email conversations, deduplicates files and applies filtering, so reviewers deal with each thread and document once.
This matters because data volume, rather than legal complexity, is what practitioners say makes requests hard. The Data Protection Network surveyed 412 practitioners in autumn 2026. Of those, 77% cited the large volume of data to be searched and assessed, and 63% cited unstructured data such as email. Only 30% cited applying exemptions other than redaction.
The same survey included one respondent whose IT pulls from email alone came to over 125GB of data. At that scale, reading the same conversation several times is a real cost in hours.
The survey was voluntary and self selected, and it leans towards larger organisations. It is best read as a strong indication of practitioner experience rather than a measure of every organisation.
Teams that want to understand the method behind this stage can use the free DSAR scoping guide.
How do saved sessions and single file handling speed up redaction?
Redaction is the process of removing or masking other people’s personal data and exempt material before a response is released. The ProvePrivacy redaction tool now compresses files into a single file before redaction begins. It also lets teams save a redaction session and restart it later, so a large request does not have to be finished in one sitting.
This is useful when a request runs to thousands of pages, or when reviewers are pulled away by other work. The tool uses AI based detection to find common sensitive data across thousands of pages in one run, with your team making the final check. A run of 12,000 pages has been tested successfully.
The tool works across common formats, including PDF, Word, Excel, PowerPoint, images, text files, ZIP archives and email formats such as MSG, EML, PST, OLM and MBOX.
Redaction remains a pressure point for practitioners. In the DPN survey, 55% cited applying redactions as a challenge, yet only 7% reported using AI powered redaction. You can read more about the tool on the ProvePrivacy DSAR redaction tool page.
How does the platform evidence exemption decisions and case activity?
An audit trail is a time ordered record of the actions and decisions taken on a case. The ProvePrivacy platform now captures the reason for each exemption from redaction and adds it to the incident audit log. System generated notes are also added to investigation notes automatically, so routine activity is recorded without extra typing.
At the end of the process, results handling collates the input, output and audit files together. A reviewer, DPO or auditor can see what came in, what went out and the decisions in between, all from the same case.
This supports accountability when a response is challenged. In the DPN survey, 67% of practitioners said requesters were dissatisfied with the response often or sometimes, and 29% had correspondence from the ICO about DSAR complaints in the previous 12 months.
Recording exemption reasons as the work is done also saves time later. Teams do not have to recall why a decision was made weeks earlier, or search several documents to explain it. Our guides on DSAR exemptions help reviewers choose and apply the right ones.
How does the secure data subject portal protect disclosure?
The secure data subject portal is a download only release channel that delivers a response through a time limited link instead of email attachments. Staff place selected files on a grant. The recipient proves control of the bound mailbox, downloads the files, and access closes once delivery is confirmed.
Key properties of the portal:
- No account or password: the data subject does not need to register
- Identity check: the recipient enters the email address bound to the grant, then a six digit code sent to that mailbox
- Lockout on wrong guesses: three wrong codes revoke the grant and email the investigator
- No files in inboxes: the email holds a link and files are downloaded through the portal
- Staff control: staff can revoke access at any time
- Audit trail: each stage is recorded, from creation to download and confirmation
A grant lasts for a maximum of 30 days and normally ends sooner, when the recipient confirms they have stored their copies. The link and one time code both travel by email, so this approach relies on the security of the recipient’s mailbox. For teams, the saving is practical: no encrypting attachments, no chasing password exchanges and no wondering whether a link is still live.
How does the Timeline tab help teams meet DSAR deadlines?
The Timeline tab is a view of a rights case that shows its progress at a glance. It sits alongside a redesigned Circumstances tab, incident stage information in the data subject rights and information management tables, and improved target date tracking. Together they make it easier to see where each request stands.
Deadlines are a constant pressure. The ICO guidance on subject access says organisations generally have one month to respond, with a further extension available where a request is complex or the person has made several requests. In the DPN survey, 64% of practitioners said they extend the deadline often or sometimes because of complexity.
When a team can see stage and target date information directly in the case list, the DPO does not need to open each case to find the ones at risk. Colleagues covering for one another can also pick up a case without a lengthy handover.
Evidence matters here too. A clear case history shows when requests were received, progressed and closed, which supports reporting to senior stakeholders.
What FOI changes support Scottish public bodies and housing associations?
The platform now supports FOI (Scotland), EIR (Scotland), CHAIRs (Housing Associations) and non regulatory request types within information management. Teams handling requests under FOIA and FOISA also gain fee and public interest delay management, request splitting and an improved closure process for requests that are not disclosed.
Each addition removes a workaround:
- Fee and public interest delay management: track delays within the case rather than in a side spreadsheet
- Request splitting: separate a request with several parts into incidents that can be managed individually
- Closure for requests not disclosed: a clearer route to close a case where information is withheld
- New request types: log Scottish and housing requests in the same system as other information requests
For information governance teams, this DSAR and FOI software means one place to log, track and evidence every type of request they receive through information request management, with the same Disclosure workflow and secure portal available for the response.
How can teams control redaction cost and branding?
Redaction page credits are now distributed automatically each month, a new redaction report helps organisations manage their redaction budget, and a Company Administrator can switch the redaction service on or off. Emails from the platform can also be sent in the client’s branding and from the client’s own domain.
The standard allowance is 12,000 redaction pages per year, released as 1,000 pages per month. The report shows usage so teams can plan ahead of busy periods, and the administrator switch gives organisations a clear control over who can use the service.
For branded sending, the organisation’s own domain is used where it has been set up and verified. Otherwise the platform sender is used. A response sent from a familiar domain is easier for the data subject to recognise.
What is ProvePrivacy Lite and who is it for?
ProvePrivacy Lite is a focused edition of the platform for organisations whose most pressing need is DSAR and FOI case management with redaction. It includes case management with deadline tracking, scoping tools, the built-in redaction tool, secure disclosure, MI dashboards and unlimited users. It costs £4,000 + VAT a year on a three year minimum term, with 12,000 redaction pages included each year, and it can be live in one day.
Teams that later need RoPA, DPIA, risk and incident management can upgrade from this DSAR and FOI software to the full ProvePrivacy platform without changing vendor, and their DSAR and FOI workflow carries over unchanged. The ProvePrivacy Lite guide sets out the full comparison.
How does the ProvePrivacy DSAR and FOI software help teams handle rights requests?
As DSAR and FOI software, the ProvePrivacy platform brings the whole post discovery journey into one case workflow: collation, scoping, redaction, exemptions, results and secure disclosure. Teams spend less time reading duplicates, rebuilding case history or chasing attachments, and they finish each request with an audit trail that shows what happened.
That combination answers two pressures at once. Workloads are rising, with 83% of the practitioners surveyed by the Data Protection Network reporting an increase in DSAR volume. At the same time, only 24% use purpose built tools to manage most of the DSAR lifecycle.
To see the update in action, book a demo of the ProvePrivacy platform today, or explore the data subject rights module. For a wider view of how the process fits together, read the DSAR process hub. If you are comparing tools, use our guide on how to choose data subject access request software, and download the DSAR response letter templates.
Frequently asked questions
Does the ProvePrivacy platform search our systems for data?
No. Discovery, the search of email, shared drives and business systems, happens in your own systems. The ProvePrivacy platform takes over once documents have been gathered, with collation, scoping, redaction, exemptions, results and secure disclosure managed in one case.
How long does the secure portal keep access open?
A portal grant has a maximum life of 30 days from release. It normally ends sooner, because access closes once the recipient confirms they have stored their copies. Staff can also revoke access at any time, and only one active grant is allowed per case.
What file types can the redaction tool handle?
The tool has been tested with PDF, Word, Excel, PowerPoint, RTF, HTML, JPG, PNG, GIF, BMP, TIFF, TXT, CSV and ZIP files. It also handles email formats including MSG, EML, PST, OLM and MBOX. It processes thousands of pages in a single run.
Who can switch the redaction service on or off?
A Company Administrator can turn the redaction service on or off for the organisation. Together with the redaction report and monthly page credit distribution, this gives teams control over usage and budget.
Is this update available on ProvePrivacy Lite?
Yes. Every addition in this update is available on ProvePrivacy Lite and on the full ProvePrivacy platform. Lite customers can upgrade to the full platform later without changing vendor.
Which FOI request types does the platform now support?
Request types now include FOI, EIR, FOI (Scotland), EIR (Scotland), CHAIRs (Housing) and non regulatory requests. For FOIA and FOISA requests there is also fee and public interest delay management, request splitting and an improved closure process for requests that are not disclosed.
