DSAR process: the system nobody remembered

A former customer asks for a copy of all the personal data the company holds about them. The privacy team searches the CRM, the marketing platform and the billing system, and sends the results three weeks later.

The customer’s reply quotes a support ticket from two years ago that isn’t in the export. The support tool, with years of tickets in free text, wasn’t on anyone’s list.

Data subject requests are the part of compliance automation with a legal deadline. The answer is only as complete as the list of systems searched.

What is a DSAR?

A data subject access request (DSAR) is a person’s request to see, correct or delete the personal data a company holds about them. The DSAR process verifies who is asking, searches every system that holds personal data, and answers within the legal deadline, with a record of what was found and done.

Why requests miss data

1. The list of systems comes from memory. The privacy team searches the systems they know about.
2. Free text isn’t searched. Names and emails inside support tickets, notes and chat don’t match a field lookup.
3. Each system is searched by hand. Someone signs in to each tool and exports what they find.
4. Deletion stops at the source. The record is deleted in the CRM, and copies remain in the warehouse.
5. The deadline is tracked in an inbox. Requests arrive by email, and the clock starts when someone notices.

What it costs

An incomplete answer is hard to fix once it’s sent, and the requester may already know what’s missing. Missed deadlines lead to complaints to the regulator. Searching by hand takes days of work for every request.

What to fix first

1. Keep one list of the systems that hold personal data. Use the same list for requests and for retention.
2. Verify the requester first. Confirm who is asking before searching anything.
3. Search every system on the list automatically. Collect the results in one place, with the system and record for each.
4. Search free text with an AI agent. It finds the person in ticket and note text, and a person checks what it found.
5. Delete in every copy. A deletion reaches the source, the warehouse and each synced tool, and each step is logged.
6. Start the clock on arrival. The request gets a due date the moment it comes in.

The guide to building data subject request automation has the prompts for each step.

Where it fits

The list of systems is shared with data retention, which deletes on a schedule what a request deletes on demand. An opt-out without deletion is handled by consent management.

For every part of compliance automation, from policy to audit evidence, see continuous compliance.