FiSAR automate subject access requests and are certified to ISO 9001, and ISO 27001.
In this short film CEO Billy Cunningham discusses how important gaining ISO 9001 and ISO 27001 is for the credibility of his tech start-up business and how instrumental Episode Consultants were in achieving certification first time.
“We went for ISO 9001 and ISO 27001 because we are a tech start up and we needed to establish our credentials to new customers. As a new company, to establish trust (with our customers) we felt that it was important to gain 9001 and 27001 so we turned to Episode Consultants and I'm pleased to say we achieved certification first time round.”
Billy Cunningham, CEO of FiSAR.
Summary
FiSAR is a UK-based tech start-up company that has developed a software platform that automates the end-to-end process of handling Subject Access Requests (SARs/DSARs) for public and private sector organisations such as police forces, educational institutions & major retailers.
Billy previously worked with Episode in other roles, most notably as the Director of Fire Safety at Landsec (who became certified to BS9997, fire safety management with our help). He knew it was important not only to become certified for quality & information security, and equally important to establish appropriate systems and processes to allow the rapid expansion of clients using the unique service they offer.
Find out more on their website.
About FiSAR
FiSAR transforms how organisations handle Subject Access Requests through intelligent automation.
It achieves full UK GDPR compliance, maintains enterprise-grade data security and eliminates the hours of manual administrative burden traditionally required to fulfil each request.
System Integration: FiSAR connects with tools like Microsoft 365, Google Workspace, and education MIS platforms (such as Bromcom and Arbor) to search emails, files, and chats.
Automated Redaction: Uses AI-assisted workflows to redact third-party data, including documents, spreadsheets, audio, and faces in images or video.
Human Oversight: FiSAR keeps a Data Protection Officer (DPO) in control to review and verify every redaction before release.
Secure Delivery: Generates an audit-ready, password-protected archive for safe disclosure.
Key Features
Time Savings: Reduces a manual process that typically takes 20 to 50 hours down to roughly 15 to 30 minutes.
Security & Compliance: Processes and stores data securely within the AWS London region (eu-west-2) with strict encryption and data separation per customer.
Audit Trail: Automatically logs every step to maintain compliance with UK GDPR and Information Commissioner's Office (ICO) guidelines.
What were the issues
Episode was involved with FISAR even before it existed as a company.
Billy shared his vision with us & we were able to ask the right questions at the right time, so that the integrated management system is core to running the business.
By their very nature, subject access requests contain highly sensitive personally identifiable information, or PII, as defined by the General Data Protection Regulations. Clearly information security management is vital - every organisation that has contacted FiSAR said they love the service, and asked when will FiSAR be certified?
The information security infrastructure put in place by FiSAR was driven by using the 93 controls that ISO 27001, Annex A, asks you to consider, meant that a robust environment was established right at the beginning,
What we did about it
Meg, our Lead Consultant of IS 27001 (having herself implemented it in a not-for-profit enterprise as CEO previously) met with Billy & the wider team to work through the principle laid out by ISO 9001 and ISO 27001, starting with business strategy.
By building the information security management system from the ground up based on risk analysis and risk treatment driven by the 93 controls the standard requires you to consider, we were able to draw on our considerable experience of how others have implemented controls to guide FiSAR.
The outcome
AS Billy highights in the video, the certification audit by a UKAS accredited certification body, went very smoothly, and finished a day early, do to the simple but comprehensive system in place.
As a side note - the system was built by Billy using AI. We are so impressed by it we are now working with FiSAR to provide Episode a new management system, and create an application our clients can us.