Roles & Permissions
SAR Portal uses role-based access control to manage what users can do within the system.
Available Roles
Admin
Full access to all features.
Admins can:
- Create, edit, and close cases
- Upload and manage documents
- Use AI features
- Delete (and restore) documents
- Anonymise cases and place cases on legal hold
- Accept a partial bulk-job archive so it can be attached to a case
- Manage users and invitations
- Change organization settings
- Manage billing and subscriptions
- View audit logs
- Access compliance features
- Delete their own account, or the whole organization if they are the last admin
Document deletion, case anonymisation, legal hold, accepting a partial archive and account deletion are Admin-only.
Recommended for:
- Business owners
- Compliance officers
- DPOs (Data Protection Officers)
- IT administrators
Case Manager
Full case management capabilities.
Case Managers can:
- Create, edit, and close cases
- Upload documents
- Use AI features
- Request information from subjects
- Submit information on a case
- Extend deadlines
- View audit logs
Case Managers cannot:
- Delete documents
- Manage users
- Change settings
- Access billing
Recommended for:
- Staff who handle DSARs day-to-day
- Privacy team members
- Customer service leads
Reviewer
Review and limited editing capabilities.
Reviewers can:
- View all cases and documents
- Update case status
- Attach documents when requesting information from subjects
- Request information from subjects
- Extend deadlines
- Use AI analysis (subject to your plan’s AI allowance)
Reviewers cannot:
- Create cases
- Submit information on a case
- Complete or close cases
- Delete documents
- Access settings or billing
Recommended for:
- Legal reviewers
- Quality assurance
- Department liaisons
Read Only
View-only access for oversight.
Read Only users can:
- View cases
- View documents
- View audit logs
- Export data (GDPR Article 20)
- Run AI analysis on a case (subject to your plan’s AI allowance)
Read Only users cannot:
- Change cases (status, details, deadlines)
- Upload documents
- Access settings or billing
Recommended for:
- Auditors
- External consultants
- Management oversight
- Compliance monitoring
Permission Matrix
| Action | Admin | Case Manager | Reviewer | Read Only |
|---|---|---|---|---|
| View cases | Yes | Yes | Yes | Yes |
| Create cases | Yes | Yes | No | No |
| Update case status | Yes | Yes | Yes | No |
| Request information | Yes | Yes | Yes | No |
| Submit information | Yes | Yes | No | No |
| Complete / close cases | Yes | Yes | No | No |
| Extend deadline | Yes | Yes | Yes | No |
| Upload documents | Yes | Yes | Request Info attachments only | No |
| Delete documents | Yes | No | No | No |
| Anonymise case / legal hold | Yes | No | No | No |
| AI analysis | Yes | Yes | Yes | Yes |
| Batch redaction workflow | Yes | Yes | No | No |
| Bulk jobs (ZIP upload, Bulk Jobs page) | Yes | No | No | No |
| Compliance verification | Yes | Yes | No | No |
| Manage users | Yes | No | No | No |
| Change settings | Yes | No | No | No |
| Manage billing | Yes | No | No | No |
| View audit logs | Yes | Yes | Yes | Yes |
| Export data | Yes | Yes | Yes | Yes |
| Delete account | Yes | No | No | No |
Choosing the Right Role
Single User Organizations
- Start as Admin (automatic for first user)
- No need to add others unless sharing work
Small Teams (2-5)
- 1-2 Admins for full control
- Case Managers for daily work
- Reviewers for quality checks
Larger Teams
- Designated Admins (limited number)
- Case Managers for processors
- Reviewers for oversight
- Read Only for auditors
Role Assignment
During Invitation
- Enter user email
- Select role from dropdown
- Send invitation
- User receives role upon activation
Changing Roles
Admins can change roles (see User Management):
- Go to Users
- Find the user
- Click role dropdown
- Select new role
- Change is immediate
Role Change Notifications
Users are not automatically notified of role changes. Consider informing them directly.
Role Best Practices
Limit Admin Access
- Only essential personnel
- At least 2 admins (for redundancy)
- Document who has admin access
Regular Review
- Audit roles quarterly
- Remove unnecessary privileges
- Adjust as responsibilities change
Separation of Duties
- Different people for case processing and audit
- Admins shouldn’t be the only case handlers
- Consider who can see what data
Training by Role
- Admins: Full system training
- Case Managers: Case workflow training
- Reviewers: Review process training
- Read Only: Navigation only
Special Considerations
Last Admin Rule
The system prevents removing the last admin:
- The last admin cannot be deleted
- The role of the only active admin cannot be changed
- Make another user an admin first; they must have signed in at least once
- Protects against lockout
Self-Role Changes
Users cannot change their own role. Another admin must make the change.
Audit Trail
All role assignments and changes are logged in the audit trail.
Related
- User Management - Inviting, changing and deleting users
- Account Deletion - Deleting your account or organization (Admin only)