We increasingly move through the world as data subjects, our lives shaped by systems we rarely see into. You have real rights in that environment: to see the data held about you, to correct it, to object to how it's used, and to contest decisions made by machines. We help people use those rights, and we help the organisations working on their behalf meet these systems on equal terms, building the tools to exercise rights at scale and bringing capable methods to their own work.
We work with organisations across three connected areas: using data rights under the GDPR, designing the processes and information flows that the work depends on, and advising on where AI and automation fit in how they operate.
The rights exist on paper. Our job is making them usable. Often the work begins with a question: you suspect something about how a system is making decisions, but you can't yet see it. We help you think through what would actually answer that, then craft it into precise requests designed to bring back what's needed, from a single well-aimed subject access request to a coordinated effort across a body of affected individuals to show how a system works.
Access is only the start. The set of rights lets you correct inaccurate data, object to how it's used, and, where a decision has been made about someone by an automated system, contest it and ask for a human review. A request or an objection may not always resolve a situation, but it's often the basis for what comes next.
We pursue rights when they aren't honoured. Where a response is inadequate, ignored, or an organisation is mishandling data, we assess where it falls short and press for what's owed, extending, where needed, to complaints to the organisation or regulator and the evidence to support a legal case.
The same requests, at any scale, produce data that has to be handled: tracked, organised, and made sense of. And most organisations hold far more besides, from casework and records to the information that moves between systems. We design those processes to be repeatable and self-sufficient, built with lightweight tooling you can own, and with the documentation and training for your team to run and sustain it.
This often matters most where an organisation is already doing the work but has outgrown the spreadsheets and inboxes holding it together. As caseloads grow, or the same kind of request comes round again, we design systems that are tailored to how you work.
AI and automation tools are becoming part of how organisations work, and the most pressing question is how to use them well. We help you work out where AI and automation fit in your processes, and bring them in with data protection built into the approach from the start. Where you already have a DPO or legal team, we work alongside them, adding the technical and practical expertise to turn principles into working practice.
We treat adoption as a question about the whole system: what a tool touches, what it changes, and what needs to be in place around it. The result is practical guidance you and your team can follow, and the governance to keep it on track as the tools change.
Groups that pursue data rights on behalf of the people they represent, run high volumes of casework and requests, or are working out how to adopt AI and automation with the data they hold in mind. We bring the data protection expertise and build the tooling around it.
Get in touchIf a company or public body holds data about you that seems wrong, or has made a decision you can't see the reasoning behind, you may have more options than you think. The right of access is usually the way in, with other rights alongside it. Tell us what's happened and we'll do our best to point you in the right direction.
Get in touchA sense of the problems this work addresses, for organisations and for individuals.
A system has quietly labelled or scored you, or your record simply holds something wrong, and it keeps affecting how you're treated. You can see what's held and the data behind it, and have it corrected.
Exercise of data rights · For individualsA chatbot or automated service got something wrong and you acted on it, or it made a decision on faulty data. You can find out what happened and challenge how it was handled.
Exercise of data rights · For individualsA higher insurance premium, a lower credit limit, or worse terms than others. Differential pricing is invisible by design, but you can ask what data and scoring put you there.
Exercise of data rights · For individualsStaff are keen to adopt new tools and the policy exists on paper, but the impact assessments and practical checks aren't happening. We help you put that layer in place and keep it running.
AI adoption & data protection · For organisationsYour records, messages or work may have been fed into an AI model, and it can surface again in what the model produces. You can ask an organisation whether your data was used, on what basis, and press for it to stop or be removed.
Exercise of data rights · For individualsThe same arbitrary, machine-driven outcomes, reported again and again. Individually hard to challenge; together, coordinated data requests can reveal how the system actually works.
Exercise of data rights · Systems & workflow design · For organisationsSubject access requests as a campaign tactic, working almost too well. Responses pile up as a chaos of emails, PDFs and spreadsheets, and the process stalls.
Systems & workflow design · For organisationsIntake, sorting, chasing, reporting: work that eats a team's time and could be streamlined. We help you find where automation and AI genuinely fit, and put it in place with your data handled properly.
AI adoption & data protection · Systems & workflow design · For organisationsStaff are already using AI, or the organisation is considering it, and no one is certain what can go where. We help you work out where these tools fit, what it means for the data involved, and what to put in place first.
AI adoption & data protection · For organisationsThe information exists, but not anywhere you can rely on or report from, and it depends on one or two people knowing where things are. We design a workflow that holds it together and that the team can run.
Systems & workflow design · For organisationsWe have spent years working with the GDPR and building the systems organisations rely on to manage their work. Much of that has been in algorithmic accountability: uncovering algorithmic harms and data protection breaches, and helping groups get the information they need to challenge the systems affecting them.
This background shapes how we work today. Acting with agency in a world shaped by data and AI takes more than knowing your rights. It takes the means to use them effectively: to press a question with persistence, to structure the work as it grows, and to reach the scale it requires. That is what this work has taught us, and what we want to bring to others.
Whether you're an organisation with a project or an individual dealing with something, write to us and tell us briefly what's happening. We read everything that comes in.
hello@datasubject.studioOrganisations and groups: if you'd like to understand how we could work together, you can book an introductory call to talk it through.
Useful to include: what decision or issue you're dealing with, who's involved, and what you'd like to understand or change. We can't take on everything. Getting in touch creates no obligation on either side, and we'll be straight with you about whether we're the right people to help, or can point you elsewhere. Please don't send sensitive documents in a first email.