Tutorial: Complete a Case End-to-End

This tutorial walks you through handling a complete Data Subject Access Request (DSAR) from receiving the request to sending the final response. Follow along in your own SAR Portal account.

Open Cases →

Cases list view - Your starting point for managing all DSARs ☀️ Light 🌙 Dark

Scenario

The Request: John Smith has submitted an access request through your public portal, asking for a copy of all personal data you hold about him.

Your Task: Gather his data, review it for third-party information, redact where necessary, and respond within 30 days.

Step 1: Review the New Case (Day 1)

When the request comes in, you’ll receive an email notification and see it in your dashboard.

1.1 Open the Case

View Cases →

1.2 Review Case Details

Check the case summary:

• Request Type: Access Request (Article 15)
• Subject: John Smith
• Email: john.smith@email.com (verified via portal)
• Date Received: Today
• Due Date: 30 days from today
• Notes: Any details the subject provided

1.3 Update Status

Change the status to show you’ve started working:

Step 2: Gather Data (Days 1-7)

Now collect all personal data you hold about John Smith.

2.1 Search Your Systems

Check all locations where you might have John’s data:

• CRM / Customer database
• Email communications
• Order history
• Support tickets
• Marketing lists
• Any other systems

2.2 Export the Data

Export relevant records as documents:

• Customer profile PDF
• Email history export
• Order records CSV
• Support ticket history

2.3 Upload Documents

2.4 Add Notes

Document what you searched:

Searched the following systems for data relating to John Smith:
- Salesforce CRM: Found customer profile and order history
- Gmail: Found 23 email exchanges
- Zendesk: Found 2 support tickets
- Mailchimp: Found on marketing list (subscribed)
- Accounting system: No records found

Step 3: Analyze Documents (Days 7-14)

Use AI to identify personal data in the documents.

3.1 Run AI Analysis

For each document:

1. Click Analyze for PII button
2. Wait for analysis (10-30 seconds)
3. Review detected entities

3.2 Identify Third-Party Data

Important: You must redact personal data belonging to OTHER people before sending to John.

From the analysis above, identify:

• John’s data (keep): john.smith@email.com, John Smith, his phone, his address
• Third-party data (redact): Sarah Jones, Mike Wilson, Emma Brown, their emails and phones

Step 4: Redact Third-Party Data (Days 14-21)

Remove other people’s personal information from the documents.

4.1 Open Redaction Editor

Click Redact on the document to open the redaction interface.

4.2 Review AI Suggestions

The AI will highlight detected PII. For each item, decide:

4.3 Apply Decisions

4.4 Apply Redactions

1. Confirm all redaction selections
2. Click Apply Redactions
3. A new redacted version is created
4. Original is preserved

Step 5: Review & Approve (Days 21-28)

Before responding, have the documents reviewed.

5.1 Mark Identity as Verified

Once you’ve confirmed the subject’s identity:

5.2 Review Checklist

Before closing, verify:

• All systems searched for subject's data
• All relevant documents gathered
• Third-party data identified and redacted
• Documents are in accessible format
• Response is within 30-day deadline
• Manager/legal approval obtained (if required)

5.3 Add Final Notes

Document your review:

Review completed by: Jane Admin
Date: [Today]
Documents reviewed: 3
Redactions applied: 8 third-party items
Response ready for delivery

Step 6: Close the Case (Day 28)

Finalize and send the response.

6.1 Prepare Response Package

Download the redacted documents to send to John:

1. Click Download on each redacted document
2. Compile into a response package
3. Include a cover letter explaining what’s provided

6.2 Send Response to Subject

Send the documents to John via:

• Secure email with attachments
• Encrypted file sharing link
• Physical mail if requested

6.3 Close the Case

6.4 Confirmation

Summary

You’ve successfully completed a DSAR by:

1. ✅ Reviewing the incoming request
2. ✅ Gathering data from all your systems
3. ✅ Analyzing documents for personal data
4. ✅ Redacting third-party information
5. ✅ Reviewing before sending
6. ✅ Closing with full documentation

Time Spent

The Audit Trail

SAR Portal has automatically recorded:

• When the case was created
• Every status change
• All document uploads
• AI analysis results
• Redaction decisions
• Who did what and when
• Final closure details

View Audit Logs →

Next Steps