How to manage data subject access requests (DSARS)

Business challenges from DSARs

The nature of modern business operations and the data-driven economy mean that volumes of personal data organisations hold are large, and constantly growing. This makes finding, collecting, collating and providing the data needed for a DSAR a significant challenge that can take a considerable amount of resources. For SMEs in particular, this can mean everything comes to a grinding halt when a DSAR comes in.

Even businesses looking for help can struggle to find it. There’s surprisingly little training on the subject of actioning DSARs and, without accessible GDPR expertise, it can be a hard for an organisation to fully understand the processes to follow. Even when companies do have a process to follow, it’s often entirely theoretical – there’s been no testing of the procedure and no relevant training. This makes for a chaotic mix.

Finding and collecting the data is only half the battle. It must be delivered to the data subject in an accessible, easy-to-understand format. This means that a simple data dump from your CMS won’t cut it, and there’s likely to be some additional (possibly manual) processing including the redaction of personal details of third parties where necessary.

Organisations facilitating DSARs must also be able to detect and respond appropriately to malicious requests. The data subject in question might have a grudge and may be aware that by requesting a DSAR they’re causing disruption to an organisation. Repetitive requests can be denied – “unfounded or excessive” is the GDPR wording – though you must build a case for why. This also highlights why it’s vitally important to keep a record of DSAR activity.

The first thing an organisation needs to do is to get processes and procedures in place that will make handling a DSAR a matter of routine. This could prove difficult without internal GDPR expertise, but there are great cost-effective services available to help, such as outsourced Data Protection Officer (DPO). Secondly, make sure it’s not just a theoretical exercise. Test the process once or twice, and you’ll soon find the ways to make it as efficient and streamlined as possible.

Part of the process-building exercise is getting to know your data. You need to know where your data is, what it holds, who you’ve shared it with, and how to access it. Most organisation who are GDPR compliant will have undergone a data mapping exercise and have built a record of processing activities (ROPA). The ICO strongly recommends all organisations hold ROPAs, as a ROPA provides valuable information around all of your processing of personal data that will make tracking that data straightforward.

Compliant organisations will already have defined, implemented a retention schedule for your data, and you’ll know where the data resides and how long you keep it for. Having a robust retention policy means holding the minimum amount of personal data for the minimum period required. This means less data to manage and sift through when satisfying a DSAR.

If you’re reading this and thinking “I’m not sure my business has data maps, ROPAs and retention schedules” then I’ve got bad news – it’s very likely that you’re not GDPR compliant. Facilitating a DSAR alone does not make you GDPR compliant.

Not all enquiries from data subjects are in fact DSARs. And knowing this can save you a lot of time and resources. A customer might just want some information about the data you hold on them without it being a DSAR.

Key to this is understanding that not everything the customer is asking for is automatically a DSAR, especially if it’s an internal request. Engaging with the person who initiated the request can help both parties: DSARs by their nature can contain a lot of information, which may be overkill for the enquirer’s requirements and might not actually answer the questions they have. By aiming to identify the purpose of the request and the scope of information they’re asking for, you can help both customer and company: the data subject gets the information they want in a clear and concise way, and the company spends less time and resources on the DSAR.

Staff training is of vital importance here – your employees need to know how to differentiate between general data enquiries and official DSARs – and if it is a DSAR, know what to do.

Making DSARs manageable

As we’ve discovered, businesses who are fully GDPR compliant will have a much easier time facilitating DSARs, as a good deal of the legwork (such as finding out the ‘what when where why who and how’ of data) will have been done already. For business who aren’t GDPR compliant, I recommend addressing that as a matter of priority. Internal GDPR expertise is often thin on the ground in many organisations, but that doesn’t mean that help isn’t available. Bulletproof’s outsourced DPO service and excellent GDPR training schemes are both great resources to help get your DSAR process embedded and tested with minimal cost.

Finally, my top tip for organisations receiving a DSAR is to stop and try to reach out to the person making the request. Try to understand the purpose of their request, their personal aims, to see if you can provide them with the information they want outside of the DSAR framework. Afterall, the best way to facilitate a complex DSAR is to make it not a DSAR in the first place..