The risk you might not see coming
A disgruntled customer. A former employee. A competitor looking to cause trouble. Anyone can submit a Data Subject Access Request (DSAR) asking for all the personal data you hold on them.
You have one month to respond. Miss the deadline or respond incorrectly, and you could face a complaint to the Data Protection Commission, which can order you to comply and, in serious cases, fine you.
DSAR scenarios restaurants can face
Requests a restaurant could receive
"Send me everything you have on me"
A customer who used your online booking system wants all their reservation history, contact details, and any notes staff made about them.
"Delete all my data"
A former loyalty programme member wants to be forgotten. You need to remove them from all systems while keeping records you legally must retain.
"I want your CCTV footage of me"
Someone claims they slipped in your premises. They're requesting CCTV footage as part of a potential claim. You need to provide it within one month. SAR Portal handles documents, emails and images. CCTV video must be reviewed and blurred outside SAR Portal.
"What do you have on me?" (from ex-staff)
A former employee who left on bad terms wants their personnel file, training records, performance notes, and any emails about them.
The personal data hiding in your restaurant
Often more than owners expect
Reservation Systems
Names, phones, emails, party sizes, special requests
Delivery Platforms
Addresses, order history, payment info, preferences
Allergy Records
Health data — highest GDPR sensitivity
Loyalty & Gift Cards
Purchase history, points, contact details
Staff Records
HR files, rotas, payroll, references
CCTV Footage
Customers, staff, delivery drivers. Video must be reviewed outside SAR Portal.
How SAR Portal makes this simple
Handle data requests in one organised place
Professional intake portal
Give customers a proper place to submit requests instead of random emails. OTP verification confirms the requester controls the email address before you share anything.
AI finds the personal data
Upload exports from your systems. Our AI scans for names, emails, phone numbers, addresses — and flags what needs attention.
AI-suggested redaction
AI suggests redactions for other people's details (for example other customers in a reservation list, or other staff in HR notes). You check them before anything is shared.
Complete audit trail
Every action is recorded in an audit log that no user can edit or delete. If the DPC ever asks how you handled a request, you have a timestamped record of each step.