How a Football Club Could Manage DSARs Across Players, Staff and Fans

The Challenge

Consider a professional football club holding personal data on current and former players, coaching and medical staff, employees, season-ticket holders and supporters. A club like this receives data requests from ex-players, former staff and fans — and the data is unusually sensitive and widely spread.

What makes a club’s DSARs difficult:

• Special-category data — player medical and injury records are among the most sensitive personal data a club holds.
• High-profile data subjects — a request from a well-known former player carries reputational as well as legal risk.
• Data spread across many systems — HR, medical and sports-science, ticketing, CRM, scouting, and matchday operations.
• Heavy third-party content — records routinely mention agents, other players, medical staff, and other supporters.

A common trigger

For many clubs the prompt is a request from a departed player or member of staff, sometimes via a solicitor. Getting it wrong — disclosing another player’s medical note, or a supporter’s details — is both a data breach and a reputational problem.

How SAR Portal Helps

Identity verification

Requests are submitted through a portal with OTP verification, which confirms the requester controls the email address on file. Where there are reasonable doubts — for example a high-profile request — the club can ask for proportionate additional ID before releasing anything.

AI-assisted redaction for sensitive records

Medical notes, HR files and correspondence are full of third-party data. SAR Portal’s AI identifies and suggests redactions for other individuals’ personal data — agents, other players, medical staff, other supporters — which the club’s team reviews and approves, while preserving the requester’s own record.

Department-level access control

Role-based access lets the club route medical requests to the appropriate staff and keep ticketing or HR data separated, so only the right people see each category.

Complete audit trail

Every access, redaction and export is logged, so the club can show exactly how a request was handled if a data subject complains to the regulator.

Illustrative Outcomes

The comparison below is illustrative of the kind of improvement a club could see — it is not measured data from a specific deployment.

Illustrative ROI:

For a club handling 10-20 requests a month across sensitive records, saving several hours per request — and reducing the risk of a high-profile disclosure error — can more than justify a Pro plan. Actual savings depend on your volume and systems.

Illustrative example — not based on a specific customer. Figures are indicative, not measured results. Clubs should ensure any DSAR solution meets their specific regulatory requirements.