How a Football Club Could Manage DSARs Across Players, Staff and Fans

The Challenge

Consider a professional football club holding personal data on current and former players, coaching and medical staff, employees, season-ticket holders and supporters. A club like this receives data requests from ex-players, former staff and fans — and the data is unusually sensitive and widely spread.

What makes a club’s DSARs difficult:

• Special-category data — player medical and injury records are among the most sensitive personal data a club holds.
• High-profile data subjects — a request from a well-known former player carries reputational as well as legal risk.
• Data spread across many systems — HR, medical and sports-science, ticketing, CRM, scouting, and matchday operations.
• Heavy third-party content — records routinely mention agents, other players, medical staff, and other supporters.

A common trigger

For many clubs the prompt is a request from a departed player or member of staff, sometimes via a solicitor. Getting it wrong — disclosing another player’s medical note, or a supporter’s details — is both a data breach and a reputational problem.

How SAR Portal Helps

Identity verification

Requests could be submitted through the club’s public request portal, where OTP verification confirms the requester controls the email address they gave. Where there are reasonable doubts, for example with a high-profile request, the club could ask for proportionate additional ID before releasing anything.

AI-assisted redaction for sensitive records

Medical notes, HR files and correspondence are full of third-party data. AI suggests redactions for other individuals’ personal data, such as agents, other players, medical staff and other supporters. The club’s team would review the suggestions and choose what to redact before anything is applied. Detected items start selected, including the requester’s own details, so the reviewer would use “Deselect Subject Data” to keep the requester’s own information in their copy. AI can miss personal data or redact too much, so the team would check the result before releasing it.

Roles and access

Four roles (Admin, Case Manager, Reviewer, Read-only) control what each person can do. Everyone with case access sees all of the club’s cases, so the club would give access only to staff who may see medical data.

Complete audit trail

Key actions are recorded in an audit log. No user can edit or delete entries. If a data subject complains to the regulator, the club could use the log to show how the request was handled.

Illustrative Outcomes

The comparison below is illustrative of the kind of improvement a club could see — it is not measured data from a specific deployment.

Illustrative ROI:

For a club handling 10-20 requests a month across sensitive records, saving several hours per request — and reducing the risk of a high-profile disclosure error — can more than justify a Pro plan. Actual savings depend on your volume and systems.

Example scenario: not based on a real customer. Figures are illustrative, not measured results. Clubs should ensure any DSAR solution meets their specific regulatory requirements.