I just received a DSAR — what should I do first?

First, don't panic. Log the request immediately with today's date — your one-month deadline starts now. Send a brief acknowledgment email to confirm you received the request. Then verify the requester's identity before proceeding. These first steps take about 15 minutes and ensure you're tracking the deadline correctly.

How urgent is a DSAR response?

You have one calendar month from receiving the request to respond. This is a legal deadline under GDPR Article 12. Missing it can result in complaints to the Data Protection Authority and potential fines. However, one month is enough time to respond properly if you start immediately and work systematically.

Can I respond to a DSAR myself or do I need a lawyer?

Most small businesses can respond to DSARs without a lawyer. You need to: verify the requester's identity, search your systems for their data, redact third-party information, compile the response, and keep records. Software tools like SAR Portal guide you through each step. Lawyers are typically only needed for complex situations or disputes.

What if I don't have time to respond within one month?

If the request is genuinely complex or you've received multiple requests, you can extend the deadline by up to two further months (three months in total). However, you MUST inform the requester within the original month, explaining why you need more time. You cannot extend simply because you're busy — the request must be objectively complex.

Just Received a DSAR? Here's What to Do Right Now

Don't panic. You have one month to respond, and SAR Portal guides you through every step to do it correctly.

Start Responding Now See the 15-Minute Plan

⏰

One Month

Your legal deadline to respond

Third-party data redaction

OTP

Identity verification built in

1 month

Due date and days left on every case

Full

Audit log of every action

Your 15-Minute Action Plan

Do these 4 things right now to get your response started

Log the Request Immediately

Record the exact date and time you received the request. Your one-month countdown starts NOW, not when you read it or forward it to someone else.

2 minutes

Don't Delete Anything

Do NOT delete any emails, files, or records related to this person. Deletion after a DSAR is received could be considered obstruction.

Immediate

Send an Acknowledgement

Reply to the requester confirming you've received their request. This buys goodwill and shows you're taking it seriously.

5 minutes

Start Your Response Process

Use SAR Portal to log the request, verify the requester's email, review AI-suggested redactions of third-party data, and close the case with your response documents.

What SAR Portal Does For You

Everything you need to respond correctly and on time

📅

Deadline Tracking

Automatic one-month deadline countdown, with overdue and due-soon cases flagged on your dashboard.

👤

Identity Verification

Built-in OTP verification to confirm the requester controls the email address on file; request more ID where you have reasonable doubts.

🤖

AI Redaction

Detects third-party personal data and suggests redactions for your team to review and approve.

📋

Evidence Pack

Records evidence of the steps you took, to support your compliance and answer regulator questions.

🔒

Secure Delivery

Requests made through your portal: the requester downloads the response from the secure portal. For other requests, you send the files yourself.

🎯

Email Templates

Pre-written emails to the requester at each step; edit their wording on Enterprise.

DSAR Response Guides

In-depth guides to help you respond correctly

📖

Start Your Response Now

Start a free trial and log your first request in SAR Portal.

Start Free Trial

Every free trial gives you Pro features for 14 days. No credit card required. Monthly plans cancel anytime.