Data Subject Access Requests (DSARs) have evolved from an administrative task into a significant operational challenge, argues AJ Thompson, CCO, Northdoor plc, pictured, the IT services firm.
While the right of individuals to access their personal data has existed for many years, awareness among employees, former staff, customers and the wider public has grown considerably. This has resulted in organisations across both the public and private sectors seeing a real increase in both the volume and complexity of requests.
The challenge is not simply that there are more requests either. Many organisations are attempting to manage a modern compliance obligation using outdated processes that were never designed to deal with such requests.
Despite significant investment in digital transformation elsewhere, DSAR management has often remained manual. Requests are still tracked in spreadsheets, with emails, documents and notes spread across multiple systems. Legal, HR, IT and data protection teams each play a role, yet there is often no single view of progress or ownership. In many organisations, successful completion of a request still depends on the knowledge of a handful of individuals rather than a consistent process. This approach may have been workable when requests were relatively infrequent, but with the huge increase in incoming enquiries it has become increasingly difficult to sustain, especially as experienced staff move on.
These issues are compounded by the way organisations now create and store information. Personal data rarely sits in one place. Instead, it is dispersed across email, Microsoft 365, Teams, SharePoint, HR platforms, CRM systems, cloud applications, archived repositories and legacy file shares. Identifying all the relevant information requires coordination across multiple departments, technologies and people, making every request time and resource intensive.
This is further complicated as individuals are increasingly aware of their data rights and are more willing than ever to exercise them. Employees and former employees now recognise DSARs as a legitimate mechanism for obtaining information held about them. Many requests also arise during workplace disputes or organisational change, increasing both legal and reputational pressures.
Against this backdrop, organisations are also working to meet statutory response deadlines which is one month under UK GDPR, while at the same time ensuring responses are complete, accurate and appropriately redacted.
Increasingly, organisations also need to demonstrate that they have followed a robust process. If asked by regulators, they will need to show evidence that searches were carried out, what information was reviewed, how decisions were made and how third-party or privileged information was protected. That level of insight is difficult to achieve when requests are managed through disconnected spreadsheets, emails and manual tracking.
Many of the technologies introduced to address DSAR management were designed for a very different world. Designed when data volumes and requests were lower and platforms were less complex, some have become costly to maintain, difficult to integrate or still rely heavily on manual processes. As request volumes continue to rise, those limitations become increasingly exposed and make it almost impossible for the organisation to process this data.
Manual processes also introduce unnecessary risk. Searching across multiple repositories increases the possibility that relevant information will be missed or non-relevant information included. Inconsistent approaches between departments also makes it harder to demonstrate that every request has been handled fairly and consistently. All of this means that multiple departments are dealing with repetitive, time-consuming tasks instead
All of this is prompting many organisations to rethink how they approach DSARs. Rather than treating every request as a standalone exercise, there is an increasing recognition that repeatable workflows, standardised processes and better visibility across information sources can improve efficiency as well as reducing risk and strengthening governance.
AI is also beginning to support this evolution by accelerating document discovery, identifying duplicate content and reducing the amount of information that requires manual processing. However, technology is not the only answer. Human involvement remains critical when looking at context, applying various exemptions and making disclosure decisions. AI should absolutely not be replacing humans, but instead supporting the governance processes.
DSAR management has become far more than a compliance exercise. It instead reflects how effectively an organisation can manage information, collaborates across departments and how it demonstrates its accountability for all the personal data it holds. Request volumes will, undoubtedly, continue to grow. As a result, organisations with consistent, defensible and auditable processes will be much better placed not only to meet regulatory obligations, but also to strengthen trust with employees, customers and stakeholders in an environment where responsible data management has never been more important.
