GDPR & Privacy Insights | SAR Portal Blog on SAR Portal – Respond to Your GDPR Data Access Request Correctly

Employee DSARs in Ireland: Handling a Subject Access Request During an HR Dispute

Wed, 28 Oct 2026 00:00:00 +0000

Short answer

Treat the request as a valid subject access request, whatever the motive. You have one month from the day your organisation received it, extendable by up to two further months where necessary, taking into account the complexity and number of requests, if you tell the employee within the first month. Search every place their data is held, redact other people’s personal data, apply exemptions only where you can name and explain them, and keep a record. Do not delete or edit anything in the meantime.

ChatGPT or Copilot for a DSAR? What to Check, and Where a Dedicated DSAR Tool Fits

Wed, 14 Oct 2026 00:00:00 +0000

Short answer

A general AI assistant such as ChatGPT or Microsoft Copilot can help with parts of a subject access request, for example drafting a plain-English cover letter. It is not built to run the request: tracking the one-month deadline, recording how you verified the requester, producing a redacted copy of every file and keeping a record of what you disclosed and why. If you want to upload real documents to one, check the plan’s terms first. A dedicated DSAR tool is designed around those steps, which is why it is usually the safer choice.

Are DSAR Portals Good or Bad? The Real Question Is Who Controls the Process

Sat, 27 Jun 2026 00:00:00 +0000

SAR Portal does not require individuals to use a portal to make a DSAR. It helps organisations manage DSARs once received, while preserving the controller’s responsibility and the requester’s rights.

Data Subject Access Requests are often urgent, sensitive and operationally difficult. They may involve emails, documents, attachments, HR files, customer records, third-party personal data, exemptions, redactions, deadline tracking and secure disclosure.

Because of this, many organisations are asking a sensible question:

GDPR Data Residency: Why Where Your DSAR Data Is Hosted Matters

Wed, 13 May 2026 00:00:00 +0000

A DSAR response is one of the most sensitive data sets your organisation will ever assemble: HR files, financial records, complaint material, special-category data, and personal data about other people. Where that data is stored, processed, and transferred isn’t a technical footnote — it’s a core part of your GDPR obligations.

Why data residency matters for DSARs

When you use any DSAR platform, that platform becomes a processor acting on your behalf, and you remain the controller. Two things follow:

DSAR Identity Verification: How to Verify a Requester Without Breaching GDPR

Wed, 15 Apr 2026 00:00:00 +0000

Identity verification is where many Data Subject Access Requests go wrong in both directions. Verify too little, and you risk disclosing someone’s personal data to the wrong person — a data breach. Verify too much, and you create an unlawful barrier to a fundamental right. The GDPR asks you to find the proportionate middle.

What the law actually requires

There is no rule that says “always demand a passport.” Under Article 12(6) of the GDPR, where you have reasonable doubts about the identity of the person making the request, you may request the additional information necessary to confirm their identity — no more.

How Long Do You Have to Respond to a DSAR? GDPR Deadlines Explained

Thu, 12 Mar 2026 00:00:00 +0000

Missing a Data Subject Access Request deadline is one of the most common — and most avoidable — GDPR failures. The rules are not complicated, but they have a few details that trip organisations up. Here’s exactly how the timing works.

The short answer: one month

Under Article 12(3) of the GDPR, you must respond to an access request without undue delay and at the latest within one month of receipt. The Irish Data Protection Commission and the UK ICO both confirm this one-month baseline (Irish DPC, ICO).

DSAR Software: What to Look for in a DSAR Management Platform (2026 Buyer's Guide)

Wed, 11 Feb 2026 00:00:00 +0000

If your organisation handles Data Subject Access Requests (DSARs), a dedicated platform can turn a stressful, error-prone manual process into a structured, auditable one. But “DSAR software” covers everything from a shared mailbox with a label to a full controller-side case management system. This guide explains what actually matters when you choose one.

What is DSAR management software?

A DSAR management platform is a tool used by the organisation responsible for handling access requests (the data controller) to receive, track, review, redact, and securely respond to requests under Article 15 of the GDPR. It is different from consumer apps that send requests on an individual’s behalf — those sit on the requester’s side, not yours.

GDPR DSAR Fines in Ireland: What Businesses Need to Know in 2026

Thu, 15 Jan 2026 00:00:00 +0000

DSARs Are the DPC’s Top Complaint Category

Data Subject Access Requests are the single largest source of complaints to the Irish Data Protection Commission. According to the DPC’s 2024 Annual Report, 34% of all complaints received relate to access requests — more than any other category.

In 2024, the DPC issued eight enforcement notices, the majority addressing organisations that failed to respond to DSARs at all.

Why the focus? The DPC has made clear that the right of access under GDPR Article 15 is fundamental, and organisations that fail to respond — or respond inadequately — will face enforcement action.

The True Cost of Manual DSAR Processing: Why Spreadsheets Don't Scale

Sat, 10 Jan 2026 00:00:00 +0000

What Does a Single DSAR Actually Cost?

Handling Data Subject Access Requests manually costs more than many businesses expect. In our illustrative example below, staff time comes to about €260-€440 per request (about 8-13 hours at €35/hour, adding up the task times in the table). Your figures will differ, and that’s before you factor in the risk of errors that can lead to regulatory action.

Let’s break it down.

The Hidden Costs of Manual Processing

1. Staff time (illustrative)

A typical manual DSAR involves:

5 DSAR Redaction Mistakes That Can Lead to GDPR Fines

Mon, 05 Jan 2026 00:00:00 +0000

Why Redaction Matters

When responding to a Data Subject Access Request, you must provide ALL personal data about the requester — but you must NOT disclose personal data about other individuals. This balancing act is where many organisations fail.

Poor redaction can turn a DSAR response into a personal data breach, sharing medical records, HR files or customer data with the wrong person.

Mistake #1: Over-Redaction

The problem: Redacting information the data subject is entitled to see.