Saving an international retailer 3,000 hours with 4x faster Disclosure Requests

Like most companies, Holland & Barrett spent considerable time and effort answering rising Disclosure Requests. With hefty potential fines for non-compliance, the team needed a way to quickly return information they could trust.

Hands holding patterned bottles in a dark, reflective scene, creating a symmetrical and abstract visual effect.

DSAR automation for a major retailer.

The Problem

Fielding a Data Subject Access Request (DSAR) is a challenging task for any organisation.

Locating the data required, ensuring nothing is missed, and redacting sensitive information prior to sharing takes a huge toll on time and resources. When you’re a retailer the size of Holland & Barrett - and dealing with multiple requests across various systems - this represents thousands of hours.

And the number of requests kept increasing. The retailer saw an 83% YoY increase in DSARs (both customer and employee) between 2023 and 2024. This rising tide of requests is a situation facing many organisations.

Complex requests that required the retailer to discover and review large volumes of unstructured data were an issue. Processing even simple DSARs took the Data Protection Office (DPO) at least a week and more complex requests took anything from four weeks to 90 days. This meant asking the Information Commissioner's Office (ICO) to extend delivery deadlines and pulling in senior colleagues or external resource to ensure compliance with the tight legal timelines.

Then there was the question of trust. Manual processes create opportunities for error and so hours had to be dedicated to manually verifying the data that was pulled. Even unintentionally withheld data increases risk, so the retailer needed a way to enhance the rigour of their work without adding extra time.

The Solution

In 2024, we came on board to help Holland & Barrett with their DSAR dilemma.

Through our Workplace AI Platform we provided the retailer with an end-to-end DSAR solution that stopped their reliance on manual, labour-intensive processes.

Our solution made DSAR setup simple and automated processing to drastically slash delivery times. The retailer now has the ability to comb through huge volumes of data - of every type, across multiple sources - in a matter of minutes. And they’re able to summon all the information they need through one solution. Aiimi’s platform even ended the headache of manual redaction - allowing the team to pinpoint and block out sensitive information with a single click. All these features have transformed the way Holland & Barrett processes Disclosure Requests, enabling them to focus their efforts on more valuable tasks.

For instance, one DSAR that Holland & Barrett received returned 18,000 documents when they ran an initial search. But, using the Aiimi platform, they were able to narrow this down to just 428 relevant documents that were suitable for disclosure. This was a win not only for the retailer but also for the data subject, who'd get the exact information they sought.

The Results

Aiimi’s DSAR solution is set to save Holland & Barrett 3,000 hours every year.

The breakdown:

Setting up a DSAR used to take Holland & Barrett a week. It now takes just 15 minutes. That’s a 95% reduction in the effort needed to set up a DSAR and savings of thousands of pounds.
More than 75% reduction in the total effort needed to deliver each DSAR. Complex Disclosure Requests would typically take at least four weeks, with some extending to between 60 and 90 days. With Aiimi, the average DSAR delivery time has dropped to one week, with some requests completed in a matter of hours.
98% reduction in effort to rerun a DSAR. In the past, when asked to re-run a DSAR by the ICO, it would take the retailer up to two weeks to reprocess a request. It now takes less than one hour as previous DSARs are retained - the team just needs to review the content.

These results position Holland & Barrett as data leaders at a time when many prominent organisations are struggling to keep up with DSAR requests. Organisations across healthcare, telecoms, and government have all received ICO reprimands regarding DSARs over recent years. Between April 2022 and March 2023, the ICO received over 15,000 complaints related to Subject Access Requests.

Significantly, Holland & Barrett is now returning data it can fully trust. This means team members don’t have to spend countless hours verifying data and can be wholly confident in their work.

Now, Holland & Barrett are working with Aiimi to realise value in other areas of their business, exploring how the Workplace AI Platform could help pre-emptively flag areas of data risk so the team gains greater visibility and control of their information. We're also exploring supporting the retailer with AI and discovery capabilities across the wider business - making finding content easy, no matter where it's stored.

“I don't know where we’d be without the Aiimi platform - it’s been a lifesaver. We’ve gone from taking a week to set up a DSAR to being able to start running a request in just a few minutes. The difference it’s made to our delivery timeline is incredible. It was taking us up to three months to process and deliver more complex Disclosure Requests and sometimes it necessitated use of the ICO’s permitted deadline extension. Now we can get DSARs out the door in a week without worry. And, crucially, we’re pulling data we can trust and which enables a data subject to receive their data more quickly!”
– Hollie Mela, Data Protection Officer at Holland & Barrett