The DSAR Problem Nobody Wants to Admit: Why Most Organisations Can’t Fulfil Requests Properly

Data Subject Access Requests (DSARs) are often described as a core right under data protection law.

They are also one of the most consistently mishandled obligations in practice.

On paper, the requirement is straightforward. An individual requests access to their personal data. The organisation must respond within statutory timeframes, providing a clear, complete, and accurate picture of the data held and how it is used.

In reality, DSARs expose something far more significant than an operational process.

They reveal whether an organisation truly understands its own data.

And for many, the answer is uncomfortable.

Why DSARs have become a persistent operational strain

DSAR volumes have increased steadily over recent years, driven by greater public awareness, regulatory visibility, and the growing use of personal data across digital environments.

What was once an occasional compliance task has become a recurring operational demand.

For DPOs, legal counsel, IT directors, and operations lead, this creates a sustained pressure point. Each request requires coordination across multiple systems, stakeholders, and decision points, often under tight deadlines and with limited visibility.

Under UK GDPR, organisations are typically required to respond within one month. While extensions are permitted in certain circumstances, they are not intended to compensate for structural inefficiencies.

That distinction matters.

Because many organisations are not missing deadlines due to complexity alone. They are missing them because the underlying processes are not designed to support consistent execution.

DSARs are no longer edge cases.

They are a recurring test of operational readiness and governance maturity.

The failure points most organisations recognise but rarely resolve

The challenges associated with DSARs are not new.

Most organisations are aware of where things go wrong.

What is less common is a coordinated effort to fix those issues at their root.

1. No centralised intake or ownership model

DSARs frequently enter organisations through multiple, uncoordinated channels.

Customer service teams, HR departments, legal inboxes, website forms, and direct emails can all act as entry points. In some cases, requests are made informally through account managers or frontline staff.

Without a centralised intake mechanism, several risks emerge:

• Requests are not recognised as DSARs at all
• Requests are logged late, compressing response timelines
• Ownership is unclear, leading to delays and duplication

This lack of control at the point of entry creates downstream inefficiencies that are difficult to recover from.

More importantly, it signals a lack of governance maturity.

An organisation that cannot reliably capture incoming DSARs cannot reliably fulfil them.

2. Manual searching across fragmented and poorly understood systems

Once a DSAR is identified, the most resource-intensive phase begins.

Organisations must locate all relevant personal data across their environment.

In practice, this means navigating a fragmented landscape of systems, including:

• Customer relationship management platforms
• HR and payroll systems
• Email servers and collaboration tools
• Document management systems and shared drives
• Legacy platforms and archived data stores

In many organisations, there is no single, authoritative view of where personal data resides.

As a result, DSAR fulfilment relies heavily on manual searches conducted by system owners or nominated individuals.

This introduces several challenges:

• Searches are inconsistent across systems
• Coverage depends on individual knowledge and effort
• Results are difficult to validate for completeness

The process becomes one of approximation rather than certainty.

What is returned is what can be found, not necessarily everything that exists.

3. The unstructured data problem

A significant proportion of personal data now exists outside traditional databases.

Emails, instant messages, meeting notes, call recordings, and collaborative documents often contain the most sensitive and context-rich information.

This data is inherently difficult to manage within DSAR processes.

Unlike structured systems, unstructured data:

• Cannot be queried consistently using standard parameters
• Requires contextual interpretation to determine relevance
• Often contains mixed data relating to multiple individuals

This creates a heavy reliance on manual review.

It also introduces subjectivity.

Different reviewers may reach different conclusions about what should be included, excluded, or redacted.

This variability is difficult to control and even harder to defend.

4. No structured redaction and legal review workflow

Once data has been gathered, organisations must determine what can be disclosed.

This is not a mechanical exercise.

It requires careful consideration of:

• Third-party personal data
• Confidential business information
• Legal privilege
• Applicable exemptions under data protection law

In the absence of a structured workflow, this process becomes fragmented.

Decisions may be made in isolation, without consistent criteria or documentation.

Under time pressure, shortcuts are often taken.

This creates two distinct risks:

• Over-disclosure, where sensitive or protected information is released
• Under-disclosure, where relevant data is withheld without sufficient justification

Both outcomes can lead to complaints, disputes, or regulatory scrutiny.

5. Inconsistent response construction and communication

Even where data is successfully identified and reviewed, the final stage often lacks consistency.

DSAR responses frequently vary in:

• Structure and format
• Level of detail provided
• Clarity of explanation
• Supporting context

From the perspective of the data subject, this can make responses difficult to interpret.

From the perspective of a regulator, it raises questions about whether the organisation has a defined and controlled process.

A DSAR response is not simply a collection of documents.

It is a formal disclosure that must be clear, intelligible, and complete. 

6. Missed deadlines and reactive extensions

Time pressure is a defining feature of DSAR management.

Where processes are manual and fragmented, delays are inevitable.

Requests may require input from multiple teams, each with their own priorities and constraints. Data retrieval may be slower than expected. Review stages may become bottlenecks.

As deadlines approach, organisations are forced into reactive decisions.

They may request extensions, sometimes without fully meeting the criteria required to justify them. Alternatively, they may respond on time with incomplete or insufficiently reviewed data.

Neither approach is sustainable.

Both increase exposure.

The regulatory shift: DSARs as a visibility and enforcement tool

Regulators are increasingly using DSARs as a means of assessing organisational behaviour.

The Information Commissioner’s Office has made clear that organisations must take reasonable and proportionate steps to locate and provide personal data.

This expectation goes beyond superficial compliance.

Organisations are expected to demonstrate that they have:

• Considered all relevant data sources
• Conducted appropriate searches
• Applied consistent decision-making processes

Where organisations fail to meet these expectations, DSARs can trigger further scrutiny.

In some cases, they act as the entry point for broader investigations into data governance practices.

This reflects a wider trend.

DSARs are no longer treated as isolated requests.

They are used as indicators of how well an organisation understands and controls its data environment.

The reputational dimension of DSAR failure

Beyond regulatory consequences, DSAR failures carry reputational implications.

Individuals are increasingly aware of their rights and more willing to challenge organisations publicly.

A poorly handled DSAR can lead to:

• Escalation to regulators
• Public complaints or media attention
• Loss of trust among customers, employees, or partners

In these situations, the narrative is rarely sympathetic to operational complexity.

Instead, it focuses on perceived transparency and accountability.

An organisation that cannot clearly explain its data practices risks being seen as disorganised or opaque.

For many organisations, that perception is more damaging than the regulatory outcome itself.

DSARs as a litmus test for data governance maturity

At a fundamental level, DSARs are not just about responding to individual requests.

They are about demonstrating control over personal data.

To fulfil a DSAR properly, an organisation must be able to answer three core questions:

• What personal data do we hold about this individual?
• Where is that data located?
• How and why is that data being processed?

These questions sit at the heart of data protection frameworks.

The difference is that DSARs require them to be answered in practice, not in policy.

This is why DSARs function as a litmus test.

They expose whether governance structures are operational, or merely documented.

Where governance is fragmented, DSARs become exercises in reconstruction.

Where governance is mature, DSARs become processes of retrieval and explanation.

Moving from reactive handling to operational capability

Improving DSAR performance requires more than incremental process changes.

It requires a shift from reactive handling to structured capability.

This involves several key components.

Centralised intake and case management

A single, controlled entry point for DSARs ensures that all requests are captured, logged, and tracked consistently.

This provides visibility over timelines, ownership, and progress.

Integrated data discovery and system coverage

Organisations must develop the ability to search across systems in a coordinated and comprehensive manner.

This includes both structured and unstructured data sources.

Reducing reliance on manual searches improves both efficiency and completeness.

Defined review and redaction workflows

A structured approach to reviewing and redacting data ensures consistency in decision-making.

Clear guidelines and documented processes reduce variability and support defensibility.

Standardised response frameworks

Consistent templates and formats improve the clarity and quality of DSAR responses.

They also ensure that all required elements are included.

Auditability and evidence

A robust DSAR process includes clear records of:

• Searches conducted
• Decisions made
• Data included or excluded

This creates an audit trail that can be used to demonstrate compliance.

Where technology and managed services make the difference

For many organisations, building these capabilities internally is complex and resource-intensive.

Technology plays an important role.

The OneTrust Privacy Rights Module provides a structured platform for managing DSAR workflows, including intake, tracking, discovery, and response management.

However, technology alone is not sufficient.

It must be implemented within a coherent operating model and supported by consistent processes.

This is where managed services become critical.

The DPG supports organisations by:

• Designing DSAR operating models aligned to regulatory expectations
• Configuring and optimising OneTrust implementations
• Providing operational support for DSAR fulfilment
• Ensuring consistency, quality, and defensibility across responses

This combination enables organisations to move from fragmented, manual processes to a professionalised capability.

The shift organisations need to make

Organisations that address DSAR challenges effectively do not focus solely on efficiency.

They focus on confidence.

Instead of asking how to respond more quickly, they ask what is required to respond with certainty.

This shift changes the focus from process to capability.

It drives investment in:

• Data visibility
• Ownership and accountability
• Integrated governance
• Sustainable operating models

Over time, this reduces not only DSAR risk, but broader data-related risk across the organisation.

Let DPG handle your DSARs

For organisations facing increasing DSAR volumes and complexity, the challenge is clear.

Manual processes, fragmented systems, and inconsistent workflows are no longer sufficient.

Professionalising DSAR management requires a combination of:

• Technology
• Governance design
• Operational expertise
• Ongoing execution

The DPG provides this capability.

Through managed services and the OneTrust Privacy Rights Module, we help organisations:

• Centralise and control DSAR intake
• Improve data discovery and completeness
• Apply consistent review and redaction standards
• Deliver clear, defensible responses
• Reduce operational burden on internal teams

The outcome is not just improved efficiency.

It is confidence that every DSAR response can stand up to scrutiny.

Sources

• Information Commissioner’s Office – Right of access guidance
  https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/
• European Data Protection Board – Guidelines 01/2022 on data subject rights (Right of Access)
  https://edpb.europa.eu/system/files/2022-01/edpb_guidelines_012022_right-of-access_0.pdf
• IAPP – DSAR trends and operational challenges
  https://iapp.org/resources/article/data-subject-access-request-dsar/
• Gartner – Data governance and information management insights
  https://www.gartner.com/en/information-technology/glossary/data-governance