Can organisations find the personal data their AI systems create? 

The Assessment Nobody Searched

Imagine your organisation receives a Data Subject Access Request (DSAR) from a former employee. The privacy team identifies the relevant HR records, emails, and internal communications, then begins the familiar work of collection and review.

What the team doesn’t know is that the employee’s manager used an AI-enabled application to prepare a performance assessment. The application generated a summary of the employee’s strengths, weaknesses, and suitability for promotion. That assessment informed management discussions, but the application was never included in the organisation’s DSAR search instructions. The team could complete its searches without ever examining the assessment.

This is a blind spot in many established DSAR processes. AI applications can do more than store or process existing information. They can generate assessments, predictions, classifications, and recommendations about individuals. Depending on their content and context, those outputs may themselves constitute personal data.

An organisation might have a comprehensive AI governance programme, with approved applications, documented risk assessments, and internal policies, yet struggle to answer a basic question when a DSAR arrives: where is the personal data its AI applications have generated, and who knows how to retrieve it?

Why DSAR Processes Need to Change Now

AI adoption has moved quickly, and the way organisations deploy these tools makes oversight difficult.

McKinsey’s 2025 global survey found that 88% of respondents reported regular AI use in at least one business function. Some 62% said their organisations were experimenting with or scaling AI agents. Nearly two-thirds had not begun scaling AI across the enterprise.

Behind those figures are very different approaches to implementation. Some organisations are running controlled pilots. Others have introduced AI through existing business applications, specialist platforms, or third-party services. Individual departments may be using tools that were never part of a coordinated enterprise rollout.

For a DSAR team, this can mean dealing with systems that have different owners, retention settings and retrieval capabilities, sometimes without a reliable record of where AI-generated information is held.

The EU AI Act has brought greater attention to transparency and oversight, but organisations cannot treat DSAR readiness as a future compliance exercise.

Article 15 of the GDPR already gives individuals rights of access to personal data concerning them, together with specified information about its processing. Information generated or inferred by AI may fall within those rights where it constitutes personal data. The immediate concern is whether the organisation’s existing procedures can find and assess that information.

AI Changes What Organisations Need to Find

DSAR searches have traditionally focused on familiar sources: emails, HR files, customer records, and business documents. AI-generated information may sit outside those locations, even when it has influenced an important business decision.

A single assessment can be harder to review than thousands of routine records. Take an AI-generated employment assessment. The organisation may need to determine what information informed it, whether the output was retained, who relied on it and how it contributed to the decision-making process.

Reviewers may also need to distinguish factual information from inferred conclusions, identify personal data relating to other people and assess any restrictions on disclosure.

Even locating the output can be difficult. A search for the individual’s name may return nothing because the application uses an employee number, customer identifier or another internal reference. The connection between that identifier and the person may be held in a separate system.

The team needs to understand how the application works and where its outputs are retained. Searching the repositories already listed in the DSAR playbook may not be enough.

There is an important legal boundary here. A DSAR does not automatically entitle someone to every document, system instruction or technical record associated with an AI application. The organisation must identify the personal data to which the individual is entitled and determine how that information should be provided. For AI-generated assessments, that can involve examining the content and its context rather than treating the output as an ordinary document to be disclosed or withheld in full.

AI Governance Alone Will Not Deliver a DSAR

An AI inventory may confirm that an application was approved, identify its business purpose, and record its risk profile. It may say very little about how to retrieve information from the system.

Consider an AI-enabled recruitment platform. Technology knows which application was approved. Procurement holds the supplier agreement. Privacy has reviewed the processing activity. Human Resources understands how the platform is used. An applicant then requests access to an assessment generated by the system.

Who establishes whether the assessment still exists? Who can retrieve it? If the supplier holds the record, who makes the request, and what turnaround time has been agreed? These are the questions that determine whether the DSAR team can actually deliver a response.

Embedded AI creates another difficulty. A new feature within an existing HR, customer service or productivity platform may not be recognised as an additional information source. Relevant records might be held in conversation histories, generated summaries, application logs, or connected repositories. Some may be retained automatically; others may be temporary.

The organisation needs to understand those arrangements. It cannot assume that every AI interaction has been retained, but it also cannot exclude a system from consideration simply because its outputs are unfamiliar to the review team.

Retrieval capabilities should be examined during procurement and implementation. Can the supplier export records relating to a particular individual? What identifiers are needed? Who has the necessary access? What happens when the information is held across more than one application?

These are practical questions, and they are considerably easier to resolve before a request is running against a statutory deadline.

Decision-Making Systems Raise the Stakes

Some AI-related requests also require a closer examination of automated decision-making.

Article 22 of the GDPR addresses decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, subject to specified conditions and safeguards. In the relevant circumstances, Article 15(1)(h) requires meaningful information about the logic involved, together with information concerning the significance and envisaged consequences of the processing.

An AI recommendation does not automatically meet that threshold. The organisation needs to establish how the system was used, whether there was meaningful human involvement and what effect the resulting decision had on the individual.

The Court of Justice of the European Union considered these obligations in its February 2025 judgment in CK v Dun & Bradstreet Austria GmbH and Magistrat der Stadt Wien (Case C-203/22).

The Court explained that meaningful information about the logic involved must describe the procedure and principles actually applied to the individual’s personal data in a concise, transparent, and intelligible manner.

This does not necessarily mean disclosing the algorithm or providing a complex mathematical explanation. The individual must, however, receive information sufficient to understand how their personal data was used to produce the relevant result.

Preparing that explanation may require input from several teams. The business owner may need to explain how the output influenced a decision. Technology specialists may need to clarify the processing involved. Legal and privacy professionals must assess what information the GDPR requires and how any competing rights should be handled. The review cannot be completed properly without understanding what happened in the underlying business process.

Trade secrets, intellectual property, and third-party rights may affect the form of disclosure, but they do not automatically remove the obligation to provide meaningful information where the law requires it.

Turn AI Readiness Into a Working DSAR Service

Most organisations do not need to build a separate DSAR function for AI. The more practical approach is to update the existing operating model so that AI-generated information is identified, retrieved and reviewed through established procedures. The connection between the AI inventory and the DSAR workflow is particularly important.

When an access request concerns an employment assessment, eligibility decision, chatbot interaction, or profiling activity, the intake team should know which systems to consider. The requester may have no idea that AI was involved, so the process cannot depend on someone specifically mentioning it. Once the relevant application is identified, there should be a clear route to its owner and an established method for obtaining retained information.

Review instructions also need to reflect the records being collected. An AI-generated assessment may contain inferred personal data, references to third parties or information requiring specialist legal interpretation. Reviewers need guidance on those issues and a clear escalation route when the circumstances warrant it.

The level of scrutiny should be proportionate. A straightforward request involving a retrievable chatbot history may follow the standard process. A disputed assessment that influenced an employment, credit, or eligibility decision is likely to require closer attention from privacy, legal, technology, or eDiscovery specialists.

This is where established information review disciplines can help. Clear collection instructions, consistent review criteria, quality checks and documented decisions allow organisations to handle complex requests without improvising a new approach each time. They also make it possible to explain what was searched, how the information was assessed and why particular decisions were made.

Test Whether the Process Works

An organisation can have a detailed DSAR policy and still discover, during a live request, that nobody knows how to export information from a particular AI application. A controlled exercise can expose that problem before it affects an actual response. Consider a customer service platform that generates interaction summaries and classifies customer enquiries. Ask the DSAR team to retrieve the retained information relating to one customer and prepare it for disclosure. Follow the exercise from intake to response.

Can the team identify the application and its owner? Does it know which records are retained and how to obtain them? Can the supplier provide the information without an unexpected delay? Do reviewers understand how to assess generated classifications or inferences? The exercise should also establish how long each stage takes. A retrieval procedure that works eventually may still be inadequate if it cannot support the applicable response deadline.

The findings will often be practical. An export function may be missing. A supplier may have no agreed process for handling access requests. The business owner may be uncertain about retention settings, or the review team may need clearer instructions. Each problem calls for a specific response, whether a technical change, a contractual commitment, a revised procedure or additional training.

Retention should be part of the test as well. Organisations should not keep every AI interaction indefinitely in anticipation of a possible future request. They should understand what information is retained, what has been deleted under established rules, and when an existing request or other legal obligation requires preservation.

The exercise is useful because it tests what the organisation can actually do, rather than what its policies say it should be able to do.

The Test of AI Accountability

AI is expanding the information organisations create about employees, customers, and applicants. Some of that information will be routine. Other outputs may influence significant decisions or require careful legal interpretation. For law departments, privacy professionals, and law firms, the priority is to understand whether existing DSAR procedures can accommodate those differences.

When someone requests personal data processed or generated by AI, the organisation should be able to identify the relevant information, retrieve it and prepare an appropriate response within the applicable deadline.

If that cannot be done through the existing process, the gap needs attention now.

Elevate works with organisations to assess and improve DSAR operations, provide specialist review capacity and deliver managed services. Our approach brings together privacy review, information discovery, eDiscovery expertise and quality controls, with escalation procedures for matters requiring closer legal or technical examination.