Accelerated Data Ingestion For PI/PHI Detection

Evidence and data. Before adopting Relativity DBR, interviewees described their organizations’ prior data ingestion and migration processes as largely manual, fragmented, and tool-dependent, with significant reliance on human effort and custom-built workflows. Interviewees noted a major advantage of DBR was its native integration with RelativityOne, which eliminated the need to move data between platforms — a process that previously introduced risk, complexity, and inefficiency.

• RelativityOne platform was widely used by all interviewees for e-discovery. Before adopting Relativity DBR, the breached data needed to be moved from RelativityOne to other data breach response tools or homegrown tools. By using Relativity DBR, it not only reduced the time and cost associated with data migration but also enhanced data security by keeping sensitive breach data within a single, controlled environment.

• Data migration between platforms not only consumed time for the interviewees’ organizations but also incurred costs related to infrastructure, bandwidth, and personnel. Relativity DBR’s in-platform processing helped mitigate these expenses. By keeping everything within Relativity, DBR avoided these reconciliation challenges and reduced the overhead associated with multiplatform workflows. The legal process engineer manager at a law firm said, “[Before DBR], there’s going to be different control number referenced in the other tool … you have to spend time cross-referencing the document that was in Relativity versus the document that was in the other tool.”

• Interviewees noted their organizations often began breach response by using Relativity’s search capabilities to reduce data volumes before ingesting into DBR. DBR supports up to 300M personal information annotations and 150M entities, represented across 1 TB of native data per DBR workspace. Interviewees shared that this culling approach enabled them to test DBR on real-world, large-scale breach scenarios with confidence and flexibility. Before deploying Relativity DBR, the interviewees were unable to gain an overview of the breached data until the review process was finished. With Relativity DBR, their organizations had a dashboard function that provided an early-stage overview of the data as long as the data ingestion was completed. This capability allowed their teams to quickly assess the scope and nature of the breach data, enabling faster decision-making and more efficient resource allocation. The VP of data mining at a legal service provider mentioned that the early-stage data visibility was valuable to teams that didn’t have the in-house tech support or data analytics support: “This upfront visibility would allow us to make more informed decisions about whether to proceed with a full manual review, which can be costly, or to determine that the exposure is minimal and not worth the additional investment. In that sense, DBR could serve as a strategic tool — not just for executing a full review but also for guiding decision-making at the outset of a breach response.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite organization bids and wins 60 cyber incident projects per year. In the prior environment where DBR was not used, the composite organization spent 8 hours migrating the data from RelativityOne platform to the legacy data breach response tool per project on average.

• The time reduction of data ingestion after deploying Relativity DBR varies based on the level of solution adoption and the configuration. For the low scenario, the composite organization uses Relativity DBR but with less configuration depending on its use cases. For the high scenario, the composite organization fully adopted Relativity DBR and configured (e.g., customize PI detectors) based on its use cases. The middle scenario sits somewhere in between. These three scenarios are used for all quantified benefits.

• The project manager is responsible for data migration normally. The fully burdened hourly rate for project managers is $39. The productivity recapture rate is 50%.

Results. This yields a three-year projected PV ranging from $3,800 (low) to $11,400 (high).

Accelerated QC On PI/PHI Detection

Evidence and data. Before deploying Relativity DBR, interviewees’ organizations faced several challenges in the quality control (QC) process during data breach response, particularly around error detection, manual data validation, and the timing of QC reviews. These issues often stemmed from the need to manually extract and normalize data, run multiple queries, and rely on late-stage sampling to catch errors — an approach that was both time-consuming and prone to oversight. Interviewees noted that Relativity DBR helped improve QC during PI/PHI detection, as highlighted by multiple interviewees. Relativity DBR enables accelerated quality control process by flagging the key area to investigate first, improving overall review accuracy, and reducing manual rework.

• The associate director of e-discovery at a professional services organization described their pre-DBR QC workflow as heavily manual and reactive. They explained that prior to DBR, teams would “really just have to sample your data for various different entities” and hope to catch errors, such as missing social security numbers or mismatched names. This reactive approach meant that QC was often delayed until the end of the review cycle, increasing the risk of inaccuracies in the final deliverables. With DBR, however, the QC process became more proactive and efficient. This interviewee noted that the tool “enables you to run your QC elements earlier and more frequently,” which directly contributed to lower error rates. By surfacing potential issues earlier in the workflow, teams could address discrepancies — such as typos in names or incorrect email associations — before they propagated through the review process.

• By streamlining the review process and minimizing manual effort, Relativity DBR reduced the QC rate along the process for the interviewees’ organizations. The same interviewee reported: “We’ve seen our QC turnover rate drop from around 5% to closer to 2% to 3% since implementing DBR. Reviewers are less frustrated because they’re catching errors earlier and spending less time on tedious corrections.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Each cyber incident project has 500 gigabytes of breached files, and each gigabyte of data has 2,000 document files on average. Cyber incidents now involve more complex data types so require more sophisticated tooling. The composite uses genAI functionality from Relativity DBR to identify and link PI/PHI with entities in unstructured data more efficiently, lowering the number of files per gigabyte ingested into DBR since the files are more complex than plain text files or emails used in other legal data intelligence area.

• With the previous tool, the average QC rate was 5%. Project managers needed to perform QC on 5% of the reviewed documents to ensure accuracy.

• With the implementation of Relativity DBR, there is a decrease in QC rate. For the high scenario, the decrease in QC rate is from 4% to 2% in three years due to the fully integration and configuration. For the low scenario, the QC rate drops to 4% in Year 3.

• The project manager spends 2 minutes on each document during QC process.

Results. This yields a three-year projected PV ranging from $454,000 (low) to $1.9 million (high).

Accelerated Data Review And Linking

Evidence and data. Before DBR, the interviewees’ organizations relied heavily on manual processes within Relativity or external tools to identify and link PI/PHI to individuals. Some interviewees’ organizations use custom-built coding to record PI/PHI and link it to entities. The process was labor-intensive and error-prone. Relativity DBR enabled reviewers at the interviewees’ organizations to link PI/PHI to individuals with minimal manual effort by providing automatic highlighting of PI/PHI and click-based entity linking. This reduced the time spent on manual review on both structured and unstructured document, which typically consumed the majority of project resources.

• Based on the interviewees’ experience, the cost structure of a typical data breach incident project was primarily composed of labor costs. The VP of e-discovery at a professional services organization shared: “Prior to Relativity, the majority of costs would be document review labor.   Relativity DBR helps reduce costs by automating data review and linking. This leads to measurable savings and positions DBR as a strategic tool for improving cost efficiency in breach response workflows.” Relativity DBR helped reduce labor costs for the interviewees’ organizations by automating data review and linking. Interviewees said this led to measurable savings and positioned DBR as a strategic tool for improving cost efficiency in breach response workflows. The head of e-discovery and litigation technology at a professional service organization commented: “Compared to our legacy product, performing the same task in DBR is significantly faster and less manual, what once took five times longer is now largely automated, making the process far more efficient and streamlined.”

• With the legacy tools, the e-discovery consultant at a law firm described that manual research and typing was required for data review and entity linking. The method often produced large volumes of false positives, requiring extensive manual review to validate the results. The interviewee mentioned: “The real challenges come to be when you want to reduce the number of false positives from search terms for personal information. So you would typically use regular expressions to try to find personal information and keywords, and it would generate a lot of responses.” Relativity DBR enabled reviewers to link PI/PHI to individuals with minimal manual effort. The legal process engineer manager at a law firm shared: “The tool will highlight the PI automatically … ideally, you can just click and say, here’s me, and then click my social security number and it ties it together automatically just with a few clicks versus typing it in.” The interviewee estimated that typing manually may take 40 seconds to a minute, while Relativity DBR’s click-based linking is “pretty much instant.”

• At the interviewees’ organizations, a high rate of false positives led to more manual work that could be avoided with Relativity DBR’s AI-driven detection, which distinguished between actual people and false hits. The associate director of e-discovery at a professional services organization provided an example: “I can see the GPT elements being a big help in PI-type identification and entity-level deduplication and removing false positives for entities. Like if I look at and it says Burger King with capital B, capital K, it sees that as a person. It’s like, ‘Well, clearly it’s not.’ So being able to readily identify or flag entities that are not likely to be people ... that’ll probably be one of the core pieces there on it.” This interviewee also provided a data point of the benefit: “I pulled the stats there for last week for a project we’re doing for a review team of five. In one week, that saved 680 hours’ worth of work.” This implied that DBR’s automation delivered over 4.5x the manual effort in value.

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The average document volume per incident is 500 gigabytes and there are 2,000 document per gigabyte of data. With the GenAI capabilities of DBR and the increasing complexity of the impacted data, there are more and more unstructured files that need to be processed with DBR so the average document count is less than average industry standard here.

• With the legacy solution, 60% of the document will be filtered and identified as documents contains PI/PHI. With increased accuracy and improvement of linking driven by GenAI, the rate drops to 50% in Year 3. It takes reviewers 1.5 minutes to review each document and record the PI/PHI and entity name on average with the previous solution.

• By deploying Relativity DBR, the false positive rate drops. Fewer documents are filtered out with PI/PHI information with higher accuracy. For the high scenario, the percentage of documents containing PI/PHI filtered decreases from 50% in Year 1 to 30% in Year 3. For the low scenario, the rate decreases from 60% to 40%. The configuration and the file type impacts the rate.

• Instead of typing information, reviewers adopt click-based recording, which increases efficiency. The review time spent per document decreases to 30 seconds in the Year 1 and 20 seconds in Years 2 and 3. For the offshore in-house reviewers, the fully burdened hourly rate is $6.49.

Results. This yields a three-year projected PV ranging $9.8 million (low) to $10.5 million (high).

Accelerated Report Generation

Evidence and data. Before adopting Relativity DBR, the interviewees’ organizations relied heavily on manual processes and custom-built tools to handle deduplication and entity report generation during data breach response. Interviewees’ organizations used SQL scripts, Python, or external analytics tools to normalize and deduplicate entity lists, requiring specialized skills. Data was often processed in one platform and exported to another for reporting, increasing the risk of metadata loss and versioning errors. Deduplication and report generation could take days or weeks, especially for large datasets with millions of entities.

• Relativity DBR automated the process of identifying and merging duplicate entities, which previously required manual review and scripting. This helped reduce errors and save time. The e-discovery consultant at a law firm shared: “The tool allows us to deduplicate individuals, and it will try to allow you to associate. That is something that can probably take a data analyst like a day or so to pull together.”

• On the entity report generation side, DBR enabled users at the interviewees’ organizations to generate entity reports directly within Relativity, reducing the need for external tools and manual reconciliation. This improved data integrity and sped up delivery. The associate director of e-discovery at a professional services organization noted, “Everything sits in one place rather than trying to work with half a dozen different tools and nothing ever matches, and it becomes a nightmare when you try to report at the end.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite organization spends 40 hours before on deduplication and entity report generation with legacy solutions on average per project.

• After the deployment of Relativity DBR, the time for deduplication and entity report generation decreased by 20% for the low scenario and 45% for the high scenario.

• The project managers are normally responsible for the deduplication and report generation. The fully burdened hourly rate for a project manager is $39 and the productivity recapture rate is 50%.

Results. This yields a three-year projected PV ranging from $23,300 (low) to $52,400 (high).

Unquantified Benefits

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• Improved employee experience and morale. Interviewees said the reviewers on their teams were doing repetitive and tedious work, which could easily lead to low morale and high turnover rate. DBR reduced tasks for reviewers, improving job satisfaction and reducing burnout at the interviewees’ organizations. The cyber practice leader at a legal service provider shared, “Reviewers are not wasting their time as much [and are] making their time more efficient. [They’re] not doing repetitive boring tasks that makes [them] want to throw [their] computer.” With increased accuracy, reviewers also got positive feedback about their results. The same interviewee commented: “The tools are pointing them in the right direction. The fewer clicks, less typing, the fewer errors you should make.”

• Strategic flexibility and workflow control. The workflow of data breach incident projects was different in each interviewee’s organization. Relativity DBR enabled the interviewees’ organizations to tailor workflows based on project needs, allowing consultative decision-making rather than rigid processes. This benefit was important in a field where every incident was unique, and rigid, cookie-cutter workflows could hinder efficiency, accuracy, and client satisfaction. The cyber practice leader at a legal service organization said: “The main reason why I say yes [to Relativity DBR] is that their set rules can be changed. … With Relativity, there’s a lot of flexibility in building your own custom rules outside of their generic rules.” What’s more, interviewees said that because DBR is embedded within RelativityOne, users could avoid data migration, maintain consistent metadata, and control the entire workflow within a single environment.

• Enhanced collaboration and product influence. As early adopters, all the interviewees had constant communication with Relativity DBR development team. The interviewees influenced DBR’s roadmap, shaping features to meet their real needs. The interviewees thought that they were the real partner of the Relativity DBR team. Relativity actively incorporated user suggestions into product updates. The e-discovery consultant at a law firm shared: “We’ve provided a lot of feedback and our suggestions are being taken on board. … A lot of those have now been implemented.”

Flexibility

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement DBR and later realize additional uses and business opportunities, including:

• Scalability. According to interviewees, Relativity DBR could handle large volumes of data and complex breach scenarios without performance degradation or excessive manual effort. The interviewees’ organizations were tested on projects with hundreds of gigabytes of data and DBR demonstrated the improvement in performance and stability over time. The associate director of e-discovery at a professional services organization mentioned, “Whenever we get a large kind of data breach case, by large, I’d be looking at anywhere from 600 to 700 gigabytes plus [post-culling], Relativity [DBR]would help us … on one workplace.”

• Global deployment and jurisdictional flexibility. DBR’s cloud-based architecture supported deployment for the interviewees’ organizations across geographies, enabling consistent workflows and data security. The head of e-discovery and litigation technology at a professional services organization shared, “We currently operate several RelativityOne instances across our global network, and DBR is fully deployed and accessible in each of these environments, ensuring consistent functionality and availability worldwide.” Also, interviewees noted that data breach incidents often involved navigating complex jurisdictional regulations and DBR supported customizable rule sets for different regions, allowing users to tailor detection parameters to local legal requirements. The cyber practice leader at a legal service provider shared, “They have set rules for each jurisdiction … but if you’re getting false hits or you’re missing something … you can actually go into the tool and fix it yourself.” This flexibility allowed this interviewee’s organization to expand into different market and reduce the compliance risks.

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Total Economic Impact Approach).