Handling data access and deletion requests without overload
In a law firm, each data access or deletion request ties up qualified people on a repetitive and sensitive task. This case shows how to structure it, make it reliable and reduce its cost by about two thirds.
The company
A law and notary firm of 35 people, advising individuals and companies and holding a large volume of sensitive files.
The problem and its cost
Requests arrive by email, by post or at the front desk, and land with whoever receives them first. There is no register, no designated owner and no clear list of where to look: document management, mailboxes, accounting, paper archives. Each request triggers a manual search, often carried out by a lawyer or a notary, against a 30-day legal deadline that someone has to track by hand. What can be deleted and what must be kept (mandates, deeds, retention obligations, professional secrecy) is decided case by case, with no common rule.
The cost is twofold. First, time: about 60 requests a year, 6 hours each, at a fully loaded hourly cost of 140 CHF, which is roughly 50,000 CHF of qualified time taken away from client files. On top of that comes the risk of a penalty or an incomplete answer, which we estimate at 25,000 CHF per year. The annual burden comes to about 75,000 CHF, not counting the discomfort of answering under pressure on topics where the firm must remain beyond reproach.
The strategy
The team chose to address the topic in a precise order. Rules first: who decides, which data must be kept, which can be deleted, and on what criteria. Automating before settling these points would have locked in inconsistent practices. Then a single route: one entry point, one register, deadlines and roles. Only after that, tooling to search the existing documents, where it genuinely saves time.
A pilot of a few weeks on live requests made it possible to adjust the templates and the retention matrix before rolling out to the whole firm. A monthly review of deadlines, handling times and contentious cases keeps the process under control over time. The investment is about 25,000 CHF, with a payback of about six months.
The execution
Team: A dedicated contact, the WALVIS core team (strategy, finance, operations, data, AI) and a legal-sector expert specialised in data protection and professional secrecy.
- →A single request register, with status, owner and legal deadline visible at a glance.
- →A retention and deletion matrix, validated by the partners, separating what must be kept from what can be removed.
- →A search procedure by source (document management, mailboxes, accounting, paper archives), with a named owner for each.
- →Response templates and a monthly dashboard tracking volumes, deadlines and special cases.
AI helps locate a person's data across existing documents and mailboxes, and prepares a draft response. A lawyer reviews and approves every answer before it is sent.
Most of the gain comes from organisation: one entry point, clear roles and a retention rule everyone knows. None of this requires a new tool, and it works with the systems already in place.
The result
Expected annual saving: 65% of CHF 75,000, about CHF 49,000. For an investment of about CHF 25,000, payback comes in 6 months.
The expected gain is 65% of the 75,000 CHF, or about 49,000 CHF per year, rather than 100%, because identity checks, legal judgment on complex cases and final sign-off remain human, and the penalty risk is reduced rather than eliminated.
- Legal deadlines met with confidence, thanks to visible tracking of every request.
- Consistent answers from one file to the next, respecting professional secrecy and retention obligations.
- Qualified time handed back to lawyers and notaries for billable work and advice.
The assumptions
- 60 access and deletion requests per year.
- 6 hours of handling per request before optimisation.
- Fully loaded hourly cost of 140 CHF.
- Avoided penalty risk estimated at 25,000 CHF per year, not a guaranteed amount.
Scenario type, built from real missions and anonymized.
In the same cocoon
