How Smartbox.ai and Microsoft are reducing DSAR costs for the NHS and local government

The NHS and local government face thousands of complex Data Subject Access Requests (DSARs) each year. This burdens frontline medical staff with extensive paperwork, diverting them from their primary role of patient care. 

Consequently, NHS waiting lists grow longer, and frustration mounts on all sides. Sorting through thousands of pages of medical notes to approve a single paragraph is a significant undertaking. Smartbox.ai aims to alleviate this burden. 

DSARs and the NHS: a snapshot

Daily, the NHS faces complex DSARs from ex-employees and patients requesting their medical records for various reasons, such as insurance or further treatment investigations.

The sheer volume of data involved is significant, including emails with numerous attachments. Manually reviewing these documents to identify and redact personal data takes approximately 52.5 hours per request, based on our analysis. It’s not only time-consuming but also monotonous for the staff involved.

In addition, our research suggests that each DSAR costs around £1,258 to process. With an organisation handling 120 requests annually, this amounts to 5,985 hours at a cost of £143,432. As mentioned above, the NHS deals with thousands – if not tens of thousands – of these requests every year.

There’s also the issue of duplication, with up to 60% of the dataset being redundant. This increases the time required and the risk of errors, such as accidentally disclosing sensitive information.

The NHS also faces significant challenges

In addition, the following challenges arise when dealing with patient DSARs: 

• Differentiating between third-party names and those of doctors and clinicians, as all third-party names must be redacted. This is a complex and time-consuming task. 

• Identifying medical record contamination, where records may have been mixed up during digitisation. This is difficult to detect and poses a significant risk, since the NHS can face substantial fines for disclosing third-party medical records.

• Accurately detecting harmful information within the dataset, such as details of abusive relationships, drug problems or sexual abuse.  

Together, these steps amount to an additional and significant manual burden for already stretched teams.

Overcoming real-world obstacles with Microsoft solutions

Smartbox.ai improves the accuracy and speed of servicing DSARs using Microsoft Azure’s form recognition and natural language processing capabilities. By leveraging these and other Azure tools, Smartbox.ai can automate the conversion of files to PDFs at the rate of around 10,000 pages per hour, while automatically identifying and highlighting personal data and duplicates.

We also developed tools to address challenges specific to the NHS. We use regular expressions to identify medical record numbers within a dataset, flagging any discrepancies. Smartbox.ai is able to locate and delete unwanted data, preventing the disclosure of incorrect records.

We work with NHS boards to create dictionaries that differentiate between third-party names and doctors/clinicians. We can list all names in a dataset, redact third-party names and retain relevant doctor/clinician names using our Bulk Redaction technology. We’ve also created a dictionary for sensitive words related to abuse, sexual assault and other critical information – allowing users to navigate to the relevant pages and decide if redaction is necessary.

While human interaction is still required, Smartbox.ai simplifies the process, enabling clinicians to focus on their core duties. Our complex tagging system highlights areas needing review, reducing the time spent on lengthy documents.

Extending innovation to local government

Local government bodies face similar challenges with DSARs, particularly when dealing with requests for personal data from residents and employees. The volume of data and the need for meticulous redaction can be overwhelming.

Smartbox.ai can streamline this process by automating data conversion, identifying personal information and flagging duplicates.

This reduces the time and cost associated with manual data review, allowing local government staff to focus on more critical tasks and improving overall efficiency.

Results that make a difference

With Smartbox.ai, the cost per case is just over £17 according to a customer survey we carried out in May 2025, and this frees up thousands of hours for NHS and local government staff. Giving doctors and government employees more time to focus on their primary responsibilities.

We’ve seen significant results with the NHS. For example, one customer reported a reduction of 36,000 files to 18,000 by eliminating unnecessary information, and cut that even further to 374 relevant files using our technology.

In another case, a high-security psychiatric hospital using Smartbox.ai reported a 70% reduction in time and effort when responding to DSARs, while also increasing accuracy and reducing risk.

Smartbox.ai has helped free up valuable resources and alleviate a significant burden for staff in our vital public services.

Working in partnership with Microsoft

Microsoft is focused on helping industry customers drive transformation, and working with AI companies like Smartbox.AI is an important part of this strategy. By integrating Microsoft solutions into our AI stack, we’re extending their capabilities to our global customer base – helping drive shared innovation at scale. The opportunity is significant, given Microsoft’s world-class AI capability and the impact of its solutions across industry.

All data points and case study examples are based on Smartbox.ai research or customer-reported outcomes and have not been independently verified by Microsoft.

Find out more

Download the e-book: Transform ISV Applications with Intelligent AI Personalisation
Watch the webinar: What is New in ISV Success – AI benefits and More 

About the author

With nearly 30 years’ experience in the IT industry, Darren currently holds the position of CRO for the 2023 AI Company of the Year, Smartbox.ai. The company uses AI to detect and redact personal and sensitive information buried within datasets and IT environments. Prior to his role at Smartbox.ai, Darren was the Managing Director at Bytes Document Solutions, and the founder and Managing Director of the channel services group, Boost Technology Group. He has been a CRN IT industry judge every year since 2016 and is a regular commentator on IT industry matters.