Why every business needs a DSAR strategy
DSARs are on the rise. But is your business ready asks Aimee Mitchell, an Associate in the Commercial and Tech department at Cripps
Data subject access requests, or DSARs, are becoming increasingly common as people become more aware of their right to understand what personal data organisations hold and how it is used.
A DSAR gives an individual the right to obtain a copy of their personal data and information about how it is processed. Responding can be complex when data is spread across email accounts, shared drives, messaging platforms and different business teams.
In most cases, organisations must respond without undue delay and within one month. This can be extended by up to two months where a request is complex or an individual has made several requests. Organisations must carry out a reasonable and proportionate search, recognise requests made verbally, in writing or through social media, and usually cannot charge a fee.
Greater awareness of data rights is one reason for the increase in requests. DSARs also frequently arise during employee disputes, workplace grievances, customer complaints or early information gathering before a potential claim. This means they may be an early sign of a wider legal or reputational issue, rather than a standalone administrative task.
Poor DSAR management creates practical risk. Reviewing large volumes of documents can be costly and time consuming, placing pressure on legal, compliance, IT and HR teams. Missed deadlines, incomplete searches or mistakes in redaction can also lead to complaints, regulatory scrutiny, legal claims and loss of trust.
Preparation can make the process more manageable. Organisations should establish clear responsibility for DSARs, train employees to recognise requests, maintain a record of decisions and identify where personal data is held. A consistent process for verifying identity, clarifying scope, searching systems, applying exemptions and checking disclosures can reduce delay and error.
Technology can help with the most resource intensive parts of the process. AI powered tools can remove duplicated documents, identify personal data, support redaction and flag difficult cases for human review. This can reduce the volume of material requiring manual review and provide greater cost certainty, particularly for organisations handling complex requests or high volumes of data.
Technology alone is not enough. Exemptions, legal privilege, third party information, redactions and sensitive employment issues often require careful judgement. AI supported review therefore works best alongside experienced human oversight and a defensible, documented process.
Cripps advises businesses on DSAR obligations, readiness and response preparation. Its commercial and technology team combines legal expertise with AI powered review tools to help organisations respond efficiently, confidently and in line with the law.
Find out more: DSAR solutions | Cripps
Discover more at: www.cripps.co.uk
