Case Actions

The case page brings together everything you need to process a request: the actions you can take, AI help, the timeline, documents, communications and the case details.

The case page for an open access request: status header, Legal Basis, AI Insights, Quick Actions, Timeline, Documents, Document Collation, Communications and Case Details ☀️ Light 🌙 Dark

Banners at the top of a case warn you about things that need attention, such as an email that could not be delivered. See Case Warnings and Banners.

Quick Actions

The Quick Actions card appears on open cases. Closed cases are read-only, so it is not shown there.

Quick Actions: Close Case, Request Info and the More Actions menu ☀️ Light 🌙 Dark

Start Processing

Shown while the case is Opened. Click it to move the case to In Progress.

Mark Verified

Confirm the data subject’s identity has been verified, with a single click.

• Click Mark Verified once you’re satisfied the requester is genuine
• Important security step before sharing personal data
• The status changes to Identity Verified and a method is recorded automatically: “Manual Review by Admin”, unless a method was already recorded (for example “Email One-Time Password” after the requester verified their email on your portal)
• There is no method picker and no verification-notes field. If you carried out extra checks, describe them in your Request Info message or in the Closure Notes when you close the case, or attach a record of them when you close it
• See Identity Verification for what gets recorded

Close Case

Finalize the case with an appropriate closure status (the red Close Case button). Admins and Case Managers can close cases.

The Close Case dialog: permanent-closure warning, Completeness Check warning, Closure Reason, Closure Notes and Attach Documents ☀️ Light 🌙 Dark

• Choose a Closure Reason (required): Completed & Fulfilled, Rejected, Withdrawn by Subject, No Data Found, Duplicate Request, or Invalid Request
• If the reason is Rejected or Invalid Request, also choose a required Refusal Ground (Manifestly Unfounded, Excessive Requests, Cannot Verify Identity, National Exemption, Third Party Rights, No Data Held, or Other)
• Add optional Closure Notes (AI-assisted) and attach any final correspondence (file picker: hold Ctrl/Cmd to select multiple)
• The dialog warns you if no identity verification method was recorded, if Document Collation sources are not yet marked Disposed, and, in a Completeness Check line, how many documents were scanned and how many referenced records have no matching file. While any source is marked Blocked, the dialog does not open: resolve the source first
• Confirm closure: this is permanent and the case moves to a read-only state

If the case is linked to other cases created from the same email, closing it may show a warning first. See Request Sequencing.

Request Info

Ask the data subject for additional information. Admins, Case Managers and Reviewers can use it.

Request Information from Subject: Request Message, Attach Documents and Send to Subject ☀️ Light 🌙 Dark

• Write a Request Message to the subject and optionally attach files (file picker: hold Ctrl/Cmd for multiple)
• Click Send to Subject. SAR Portal sends the email
• The case status changes to Awaiting Information
• On UK cases you can also tick Stop the statutory clock while awaiting this response (see Deadlines & Extensions)
• The subject can reply through your portal, or your team can record their reply with Submit Info

While the case is Awaiting Information, the button reads Send Follow-up, so you can send a follow-up or reminder.

Submit Info

When a case is in Awaiting Information, an Add Information Provided by Subject section appears so Admins and Case Managers can record the information received on the subject’s behalf (and attach files), then click Submit Info. The case moves to Information Received.

More Actions Menu

The More Actions menu holds:

Extend Deadline

• Request additional time for complex cases
• In Select Extension Period, choose 1 Month or 2 Months (capped at the two further months GDPR permits)
• Enter a Reason for Extension (required, unless your organisation uses a custom extension email template; then the field is optional Additional Notes)
• The subject is automatically emailed about the extension. If the case has no email address, no email is sent and you need to tell the requester another way
• See Deadlines & Extensions

Communications

• Resend Last Email sends the last notification to the subject again

Data Export (EU & UK GDPR Art. 20)

• Export as JSON downloads the case data in a machine-readable format
• Export as PDF downloads it as a human-readable document

If an Admin has turned off a status in Settings > Case Management (Enabled Case Statuses), the Start Processing, Mark Verified or Extend Deadline button that sets it is hidden.

Delivering the Response

SAR Portal does not generate response letters: you attach your own response documents when you close the case.

• Any requester whose case holds their email address can open your portal link, verify their email with a one-time code, and see and download their cases. This works whether the case came from the portal or your team created it.
• For cases with no email address, or one the requester cannot receive mail at, download the documents and send them yourself by a secure channel such as encrypted email or an encrypted file-sharing link.

See Downloading Your Files for what the requester sees.

GDPR Actions on Closed Cases (Admin only)

When a case is closed, a Case Closure Information panel appears. Admins see two extra controls there. They are not available to Case Managers, Reviewers or Read-Only users, and they do not appear on open cases.

Manual Anonymization

Click Manual Anonymization to remove contact PII while keeping a compliance record. A dialog opens where you:

• Choose a Reason for Early Anonymization and enter Additional Notes (required, at least 20 characters)
• Tick the mandatory “irreversible” confirmation checkbox
• Optionally choose to notify the subject by email
• Click Confirm Anonymization

Anonymization clears the subject’s contact details (name, email, phone) but preserves a salted email hash so you can still verify a future request relates to the same person. It is irreversible and removes the case’s documents from storage. Use it in line with your retention policy once the response has been delivered.

Legal Hold

Protect a closed case during a dispute or litigation.

• Place Legal Hold asks for a Legal Hold Reason, then stops the case from being deleted or anonymized while a matter is ongoing
• Release Legal Hold lifts that protection once the matter concludes
• Use a legal hold whenever a case may be relevant to a complaint, regulatory inquiry, or legal claim

AI Insights

The AI Insights card gives you AI help on the case. Click Analyze with AI (it reads Re-analyze after a run) to fill three sections:

• What to do next - next-step guidance and action items for the case
• Completeness - records the documents mention that have not been supplied yet
• Disclosure - documents that could not be checked for third-party personal data

On a closed case the card is read-only and the button is hidden. See AI Insights for the details.

Legal Basis Links

The Legal Basis panel links to the official text and the regulator’s guidance, depending on the case’s jurisdiction:

• EU GDPR Text and EU Guidelines (EDPB) for EU cases
• UK GDPR Text and UK Guidelines (ICO) for UK cases

Timeline

The Timeline panel shows the case’s history, one entry per status it has been through (for example Opened, Awaiting Information, Information Received and Deadline Extended).

The Timeline: status entries with the request messages and the documents attached at each step ☀️ Light 🌙 Dark

Each entry shows:

• Date and time
• The status and what happened, such as the information request sent to the subject
• The documents attached at that step (reference documents sent, documents submitted, supporting documents attached at closure)

Every action is also recorded in the audit log.

Document Management

Attaching Documents

There is no standalone upload button and no drag-and-drop area. Files are attached only through one of these flows, each of which opens a file picker (hold Ctrl/Cmd to select multiple files):

• Request Info - attach files when asking the subject for more information
• Submit Info - attach files when recording information received (only while the case is “Awaiting Information”)
• Close Case - attach final correspondence as you close

When you attach redactable files, PII detection runs automatically: see AI Redaction below. Supported formats include PDF, Word, Excel and images.

AI Redaction (on attach)

There is no per-document “Analyze for PII” button. Instead, attaching redactable files kicks off the redaction flow automatically:

1. PII detection runs on the attached files
2. A Review Detected PII screen lists the entities found. Every detected item starts selected, including the requester’s own details
3. Click Deselect Subject Data (or untick items) so the requester’s own information stays in their copy, check the selection, then click Redact Selected (n)
4. Review the redacted result, then Confirm & Attach to Case (n)
5. Or choose Skip Redaction to attach the files unchanged

Document processing counts against your plan’s page allowance. See AI-Powered Redaction.

Document Actions

The Documents panel, with View, Download and Delete for each document ☀️ Light 🌙 Dark

For each attached document:

• View - Open in browser
• Download - Save locally
• Delete - Soft-delete with a reason (admin only, with audit trail): see below

Deleting and Restoring Documents

Document deletion is admin only and available only while the case is open and the subscription is active.

• Click Delete to open the Delete Document dialog
• Choose a Reason for Deletion (Wrong File, Duplicate, Sensitive, User Request, or Other) and add optional notes
• The document is soft-deleted: archived and restorable until the case is closed
• Deleted documents show a Restore button while they remain restorable

Case Details Panel

The Case Details panel shows:

• Case Id
• Received At - Admins and Case Managers can change it with the edit icon while the case is open
• Verified At and Is Extended
• Internal Target - your own earlier goal, set with the flag icon (see Deadlines & Extensions)
• Governing law - only when your organisation handles several jurisdictions
• Statutory clock - UK cases only, with Stop the clock and Restart the clock
• Case Retention Period (months) - overrides your organisation’s default for this case
• Subject Notes - the notes entered when the case was created, or sent with a portal request. They are read-only on the case page. Deadline extension details are added automatically
• Subject Name, Subject Email and Subject Phone - Admins and Case Managers can correct them with the edit icon (Edit contact details (GDPR Article 16))

Communications

The Communications panel lists the emails SAR Portal has sent for the case, with the Date, Type, Recipient and Subject of each.

Best Practices

Regular Timeline Review

• Check the timeline to understand case history
• Verify all required steps completed
• Identify any gaps or delays

Document Everything

• Put the details of phone calls and other contact in your Request Info messages, or in the Closure Notes when you close the case
• Attach supporting records when you close the case
• Record the reason for your decision in the Closure Notes

Use AI Insights

• Run Analyze with AI before making decisions
• Review the suggested next steps and the Completeness and Disclosure sections
• Reference GDPR articles when needed

Verify Before Disclosing

• Always click Mark Verified before sharing personal data: the method is recorded automatically
• Note any extra identity checks you carried out in your Request Info messages or Closure Notes
• Especially important for email/phone requests received through unverified channels