Quick Reference
A printable quick reference for handling DSARs with SAR Portal.
App Quick Links
Request Types at a Glance
| Type | Article | What They Want | Deadline |
|---|---|---|---|
| Access | Art. 15 | Copy of their data | one month |
| Erasure | Art. 17 | Delete their data | one month |
| Rectification | Art. 16 | Correct wrong data | one month |
| Restriction | Art. 18 | Freeze processing | one month |
| Portability | Art. 20 | Data in portable format | one month |
| Objection | Art. 21 | Stop processing | one month |
| Automated Decision Objection | Art. 22 | Human review of AI decision | one month |
Case Status Flow
┌──────────┐ ┌─────────────┐ ┌───────────────────┐ ┌───────────────────────┐
│ Opened │ ──▶ │ In Progress │ ──▶ │ Identity Verified │ ──▶ │ Completed & Fulfilled │
└──────────┘ └─────────────┘ └───────────────────┘ └───────────────────────┘
│ │
▼ ▼
┌──────────────────────┐ ┌───────────────────┐
│ Awaiting Information │ │ Deadline Extended │
└──────────────────────┘ └───────────────────┘
Deadline Calculator
| Received | Due Date (one month) | Extended Due (three months) |
|---|---|---|
| 1 May | 1 June | 1 August |
| 15 May | 15 June | 15 August |
| 31 January | 28 February (29 in a leap year) | 30 April |
Response Checklist
Before Responding
- All systems searched for subject's data
- All relevant documents gathered
- Third-party data identified
- Redactions applied to protect others
- Documents in accessible format
- Within deadline
- Approved by appropriate person
When Closing
- Response sent to subject
- Delivery method documented
- Closure Notes written (they are emailed to the requester)
- Correct closure reason selected
Closure Reasons
| Reason | When to Use |
|---|---|
| Completed & Fulfilled | Request fully satisfied |
| No Data Found | No data found about the subject |
| Rejected | Request refused (e.g. identity not verified, manifestly excessive, exemption applies) |
| Withdrawn by Subject | Subject cancelled their request |
| Duplicate Request | Same request already being handled |
| Invalid Request | Request is not a valid DSAR |
User Roles
| Role | Create Cases | Edit Cases | Delete Docs | Manage Users | Billing |
|---|---|---|---|---|---|
| Admin | ✅ | ✅ | ✅ | ✅ | ✅ |
| Case Manager | ✅ | ✅ | ❌ | ❌ | ❌ |
| Reviewer | ❌ | Status only | ❌ | ❌ | ❌ |
| Read Only | ❌ | ❌ | ❌ | ❌ | ❌ |
Notes: Document deletion is Admin-only. Case Managers can create, manage, close cases and upload, but cannot delete documents or manage billing. Reviewers can update status, upload, and request info, but cannot create cases, submit info, or close cases. Read Only can view and export only.
Plan Limits
| Plan | Cases/Month | Users | Storage | Price (ex VAT) |
|---|---|---|---|---|
| Basic | 1 | 1 | 2 GB | €29/month or €199/year |
| Starter | 5 | 3 | 10 GB | €59/month or €590/year |
| Pro | 25 | 10 | 50 GB | €199/month or €1,990/year |
| Enterprise | No monthly case cap | 50 by default (more by contract) | 500 GB (more by contract) | From €3,000 a year ex VAT, billed annually |
File Limits
| Type | Max Size | Formats |
|---|---|---|
| Documents | 100 MB | PDF, DOCX, DOTX, DOCM, DOTM |
| Spreadsheets | 100 MB | XLSX, XLSM, XLTX, XLTM |
| Presentations | 100 MB | PPTX, PPTM, POTX, POTM |
| Images | 100 MB | PNG, JPG, JPEG, GIF, BMP, TIFF, TIF, WebP (WebP is accepted but not redacted automatically) |
| 100 MB | EML, MSG (auto-converted) | |
| Text | 100 MB | TXT, CSV, LOG, MD, JSON, XML, HTML, CSS, JS |
Max file size: 100 MB on paid plans, 10 MB per file on the free trial (the trial also limits files per case). Batch uploads: up to 250 MB in total on the trial and Basic, 500 MB on Starter, 1 GB on Pro and Enterprise. Legacy .doc and .xls are not supported.
PII Types Detected by AI
Personal Identifiers
- Names, Email addresses, Phone numbers
Government IDs
- Passport, National ID, SSN/PPS, Driver’s license
Financial
- Bank accounts, Credit cards, IBAN
Location
- Addresses, Postcodes
Health
- Medical conditions and medications
Digital
- IP addresses, Usernames, Device IDs
When You Can Refuse
| Reason | Example |
|---|---|
| Can’t verify identity | Person won’t provide ID verification |
| Manifestly excessive | 5th identical request this month |
| Manifestly unfounded | Clear harassment/bad faith |
| Exemption applies | Legal privilege, ongoing litigation |
| Third-party rights | Would expose others’ data (usually redact that part rather than refuse the whole request) |
Where to Find Things
| To… | Go to |
|---|---|
| See all cases | Sidebar → Cases → All Cases |
| Create a case | Sidebar → Cases → New Case |
| Import past cases | Sidebar → Cases → Import Past Cases |
| Manage users (Admin) | Sidebar → Users |
| Compliance proof search (Admin) | Sidebar → Compliance → Verification |
| Audit logs (Admin) | Sidebar → Compliance → Audit Logs |
| Settings (Admin) | Sidebar → Settings |
| Billing & plan (Admin) | Sidebar → Billing |
Common Actions
Create a case
Sidebar → Cases → New Case → choose "Manual Entry" or "From Email" → fill in the form → Create Case
Add documents to a case
Documents are attached through a case action — there is no standalone upload button:
Response documents: Open the case → Close Case → attach files (sent to the requester)
A request to the subject: Open the case → Request Info → attach files (sent to the subject)
What the subject sent: Open the case → Submit Info → attach files (while Awaiting Information)
The file picker lets you select several files at once (hold Ctrl on Windows / Cmd on Mac). Attach the requester’s data at Close Case, not at Request Info: Request Info sends its attachments to the subject.
Redact PII
Redactable files you attach are scanned automatically — there is no separate “analyze” button:
Attach files → Review Detected PII → Deselect Subject Data → check what to redact → Redact Selected → review → Confirm & Attach to Case
You can also choose Skip Redaction to attach files unchanged.
Verify identity
Open the case → Mark Verified
One click; the status change is logged with the time and user in the timeline and audit log. If no verification method is recorded on the case yet, it is recorded as Manual Review. (A public-portal request records the email one-time code as its method once the requester signs in to the portal again after submitting.)
Extend a deadline
Open the case → More Actions → Extend Deadline → choose 1 month or 2 months → add a reason → Extend Deadline
If the case has a requester email address, they are emailed about the extension. If it has none, no email is sent and you must tell them another way.
Close a case
Open the case → Close Case → choose a Closure Reason (and a Refusal Ground if rejecting) → write the Closure Notes → attach the response documents → Close Case
The Closure Notes and the documents you attach go to the requester with the closure email. For an access request, put the Art 15(1) information in the Closure Notes.
Invite a user (Admin)
Sidebar → Users → Invite User → enter email → select role → Send Invitation
Admin-only case actions
- Delete a document: open the case → the document’s Delete button → choose a reason. This is a soft delete — restorable until the case is closed.
- Anonymise a case: open a closed case → Manual Anonymization (irreversible; removes the case’s documents).
- Legal hold: open a closed case → Place Legal Hold / Release Legal Hold.
Both appear in the Case Closure Information section, which a case has only once it is closed.
Emergency Contacts
| Need | Contact |
|---|---|
| Technical Support | support@sarportal.com |
| Security Issues | security@sarportal.com |
| Data Protection | dpo@sarportal.com |
| Billing Questions | support@sarportal.com |