We increasingly move through the world as data subjects, our lives shaped by systems we rarely see into. You have real rights in that environment: to see the data held about you, to correct it, to object to how it's used, and to contest decisions made by machines. We help people use those rights, and we help the organisations working on their behalf meet these systems on equal terms, building the tools to exercise rights at scale and bringing the same capabilities to their own work.
We work with organisations across three connected areas: using data rights to get at information and put it to use, designing the systems that make that work manageable, and advising on where AI and automation fit in how they operate. Years of exercising rights and challenging automated systems taught us how these systems behave in practice. We put that to work advising on them, and designing the workflows around them.
The rights exist on paper. Our job is making them usable. Often the work begins with a question rather than a request: you suspect something about how a system is making decisions, but you can't yet see it. We help you think through what would actually answer that, then shape it into precise requests designed to bring back what's needed, from a single well-aimed subject access request to a coordinated effort across a whole affected group that can show how a system works across a lot of people at once.
Access is only the start. The same body of rights lets you correct inaccurate data, object to how it's used, and, where a decision has been made about someone by an automated system, contest it and ask for a human to look again. We work across that full range, and we're honest that a request won't always resolve a situation, though it's often the way to understand it and the basis for what comes next.
We also pursue rights when they aren't honoured. Where a response is inadequate, ignored, or an organisation is mishandling data, we assess where it falls short and press for what's owed, extending, where needed, to complaints to the organisation or regulator and the evidence to support a legal case.
The same requests, at any scale, produce data that has to be handled: tracked, organised, and made sense of. And most organisations hold far more besides, from casework and records to the information that moves between systems. We design how that work runs, so it's repeatable and stays with the team rather than one person, built with lightweight tooling you can own, with documentation and training that keep it in your hands.
This often matters most where an organisation is already doing the work but has outgrown the spreadsheets and inboxes holding it together. As caseloads grow, or the same kind of request comes round again, we design systems that fit how you actually work.
These tools are becoming part of how organisations work, and the useful question is how to do it well. We help you work out where AI and automation fit in your processes, run the data protection impact assessments new tools call for, and set up the policies, guidance and working practices that let a team use them with confidence.
We come to this from years of scrutinising automated systems, so we know where their faultlines tend to be. We treat adoption as a question about the whole system: what a tool touches, what it changes, and what needs to be in place around it. The result is plain, practical guidance a team can follow, and the governance to keep it on track as the tools change.
Groups that pursue data rights on behalf of the people they represent, run high volumes of casework and requests, or are working out how to adopt AI and automation with the data they hold in mind. We bring the data protection expertise and build the tooling around it, tailored to how you work.
Get in touchIf a company or public body holds data about you that seems wrong, or has made a decision you can't see the reasoning behind, you may have more options than you think. The right of access is usually the way in, with other rights alongside it. Tell us what's happened and we'll do our best to point you in the right direction.
Get in touchA sense of the problems this work addresses, for organisations and for individuals. In each, a right that already exists is usually the way in.
A system has quietly labelled or scored you, or your record simply holds something wrong, and it keeps affecting how you're treated. You can see what's held and the data behind it, and have it corrected.
Exercise of data rights · For individualsA chatbot or automated service got something wrong and you acted on it, or it made a decision on faulty data. You can find out what happened and challenge how it was handled.
Exercise of data rights · For individualsA higher insurance premium, a lower credit limit, or worse terms than others. Differential pricing is invisible by design, but you can ask what data and scoring put you there.
Exercise of data rights · For individualsStaff are keen to adopt new tools and the policy exists on paper, but the impact assessments and practical checks aren't happening. We help you put that layer in place and keep it running.
Data protection & AI adoption · For organisationsYour records, messages or work may have been fed into an AI model, and it can surface again in what the model produces. You can ask an organisation whether your data was used, on what basis, and press for it to stop or be removed.
Exercise of data rights · For individualsThe same arbitrary, machine-driven outcomes, reported again and again. Individually hard to challenge; together, coordinated data requests can reveal how the system actually works.
Exercise of data rights · Systems & workflow design · For organisationsSubject access requests as a campaign tactic, working almost too well. Responses pile up as a chaos of emails, PDFs and spreadsheets, and the process stalls.
Systems & workflow design · For organisationsIntake, sorting, chasing, reporting: work that eats a team's time and could be streamlined. We help you find where automation and AI genuinely fit, and put it in place with your data handled properly.
Data protection & AI adoption · Systems & workflow design · For organisationsStaff are already using AI, or the organisation is considering it, and no one is certain what can go where. We help you work out where these tools fit, what it means for the data involved, and what to put in place first.
Data protection & AI adoption · For organisationsThe information exists, but not anywhere you can rely on or report from, and it depends on one or two people knowing where things are. We design a workflow that holds it together and that the team can run.
Systems & workflow design · For organisationsWe have years of experience using the GDPR and building the systems and workflows that organisations rely on to manage their cases. Much of that work has been in algorithmic accountability: uncovering algorithmic harms and data breaches, and helping groups get hold of the information they need to understand and challenge the systems affecting them.
That background shapes how we work today. We increasingly live alongside automated systems that decide things about us at scale, and navigating that environment takes the right tools to exercise your rights and the judgement to use new ones well. Having spent years challenging these systems and contesting how data is used, we know where their risks sit and how to design one that stands up to scrutiny. We think those capabilities should be more widely shared.
Whether you're an organisation with a project or an individual dealing with something, write to us and tell us briefly what's happening. We read everything that comes in.
hello@datasubject.studioOrganisations and groups: if you'd like to understand how we could work together, you can book an introductory call to talk it through.
Useful to include: what decision or issue you're dealing with, who's involved, and what you'd like to understand or change. We can't take on everything. Getting in touch creates no obligation on either side, and we'll be straight with you about whether we're the right people to help, or can point you elsewhere. Please don't send sensitive documents in a first email.