Redact DSARs in minutes, not afternoons.
Ghost is the AI-native DPO console for EU and UK companies. Upload a subject access request and we detect and redact the PII for you. Article 15 deadlines, the Article 30 register, and DPIAs are built in.
Built to the same data-protection standards as regulated financial software.
No credit card required · Free for 30 days
AI-assisted redaction
The bulk of DSAR work, automated
Upload PDFs, images, or screenshots. Ghost detects PII automatically — names, addresses, IDs, contact details — and proposes redactions you can accept, reject, or refine. Export a clean redacted file in minutes instead of an afternoon. The kind of work that costs paralegal hours; Ghost cancels them.
- PDFs, images, and screenshots
- AI-powered PII detection on Pro and Team
- Batch processing and resumable sessions
Privacy requests (DSAR/SAR)
Subject access requests from intake to closure
A branded public intake form, identity verification, and the Article 15 / 30-day deadline clock running on every case. Assign tasks, redact attached documents with the built-in tool, assemble response packs, and deliver via secure time-limited links. Every action recorded in an append-only audit log.
- Public intake forms with identity verification
- Article 15 deadline tracking with reminders
- Response pack assembly with redacted attachments
DPIAs (Article 35)
DPIAs with risk scoring and DPO sign-off
Run Article 35 DPIAs with guided questionnaires, risk registers, mitigation tracking, and structured review flows. Connected to your RoPA so high-risk activities are flagged before they generate a DSAR you didn't budget redaction time for.
- Article 35 screening and assessment templates
- Risk registers with mitigation tracking
- DPO review and sign-off workflow
Records of Processing Activities (RoPA)
Article 30 records that stay audit-ready
Stop managing your Article 30 register in spreadsheets. Guided templates, built-in validation, gap analysis to catch what's missing, and regulator-ready PDF or Excel exports. Annual review reminders keep your register current.
- Guided templates for common processing activities
- Gap analysis and completeness scoring
- PDF and Excel export
See the workspace end to end
A short walkthrough of redaction, DSARs, DPIAs, and the Article 30 register.
For every role on the privacy team
Privacy isn’t one person’s job. Ghost gives every role on the programme the surface they need — on the same record, with the same audit trail.
Data Protection Officers
Move your Article 30 register, DSARs, DPIAs, and breach logs out of email threads and shared drives. One workspace, one audit trail, one source of truth.
Read the DPO briefPrivacy Counsel
Stop reconstructing the record after the fact. Ghost captures the trail of decisions, identity checks, and disclosures as they happen — so when counsel is asked to defend a position, the evidence is already there.
Read the counsel briefCompliance Leads
Quarterly review is now a deployment gate. Ghost gives compliance leads exportable, regulator-grade evidence pre-mapped to the frameworks supervisors and procurement teams already work with.
Read the compliance briefSecurity & Engineering
EU data residency, encryption in transit and at rest, time-limited disclosure links, and an append-only audit trail. Privacy plumbing that doesn’t become the weakest link in your control framework.
Read the security briefFor the sectors with the highest privacy load
Ghost is designed for the teams handling the highest-volume, highest-risk subject access workflows under GDPR and equivalent regimes.
Dental practices (Ireland)
Patient record and subject access requests without the scramble — log, redact, respond within one month, and keep proof of what you sent.
Read the Irish dental briefHealthcare
Subject access against clinical records, with redaction of third-party identifiers and special-category data. Every disclosure logged against the patient record.
Read the healthcare briefHR & Employment
Employee DSARs across HRIS, payroll, performance, and grievance files. Redact third parties, track deadlines, and keep the chain of custody clean.
Read the HR briefLegal & Professional Services
Subject access against matter files with privilege redactions, plus an Article 30 register that survives a regulator inspection.
Read the legal briefFinancial Services
DSARs across KYC, transactions, and complaints files. Built for teams handling subject access alongside AML obligations and supervisory scrutiny.
Read the financial services briefSaaS & Platforms
Public intake forms, multi-tenant request handling, and webhook export. Built for companies whose customers expect a self-serve privacy experience.
Read the SaaS briefPublic Sector
Subject access workflows for teams handling high request volumes against the public, with mandatory disclosure timelines and audit trails.
Read the public sector briefCompliance Hub
The privacy ops that go with the redaction
Redaction is the wedge. Everything else — breach response, vendor management, DPIAs, consent, training, retention — is the legal scaffolding that decides what gets redacted in the first place and defends the work when it's challenged.
Log and track personal data breaches with authority notification timelines
Screening criteria, risk registers, and DPO sign-off
Three-part balancing tests for legitimate interests
Track processors, DPA status, and transfer mechanisms
Processing activities grouped by lawful basis under GDPR Art. 6
Record consent, track withdrawals, link to your Article 30 register
Track privacy training completions and renewal dates
Privacy policies with versioning and review dates
Retention schedules and deletion review tracking
Design Partner Program
Co-build Ghost with us
Free access for a small cohort of privacy teams shaping the workspace around real-world workflows. We’re reviewing applications weekly.
Start your 30-day free trial
Try the full platform free for 30 days — AI-assisted redaction, Article 30 register, DSAR workflows, DPIAs, and the Compliance Hub. No credit card required.
Start Free TrialFAQ