DSAR management
Handle data subject access requests from submission to completion. Track SLA deadlines, assign tasks to your team, and provide a public portal for data subjects to submit requests, all with privacy-by-design data handling and automatic PII redaction. On the hosted service it is included, with up to 100 requests a month through the public form (1,000 with the volume upgrade).
Request lifecycle
Every DSAR moves through a defined lifecycle with automatic SLA tracking. The system monitors deadlines and alerts your team when action is needed.
Submitted
Request received
Identity check
Verify data subject
In Progress
Processing request
Review
QA before delivery
Completed
Response delivered
Privacy by design
PrivacyCloud is designed so that facilitating DSARs does not create new privacy risks. We collect the minimum data needed, redact it automatically after the retention period, and never include individual PII in reports.
Data minimization
The intake form collects only name, email, and request type. Phone and relationship are optional. Address is never collected via the portal.
Consent at intake
Data subjects must explicitly consent to processing before submitting. The privacy notice explains retention periods and redaction.
Auto-Redaction
After the retention period (30 days after closing on the hosted service; 90 days by default when self-hosted), all personal data is automatically replaced with 'REDACTED'. The anonymized audit trail is preserved.
PII-Free reports
The DSAR Performance Report contains only aggregated metrics: request volumes, SLA rates, type distributions. Zero individual data.
Manual redaction & deletion
Admins can manually redact PII or hard-delete completed requests at any time, without waiting for the retention period.
Audit trail integrity
Actions, timestamps, and staff IDs are preserved after redaction. Who did what and when remains traceable; only the data subject's PII is removed.
Request types
PrivacyCloud supports all GDPR data subject rights as request types.
Right to access personal data held by the organization (Art. 15)
Right to be forgotten: deletion of personal data (Art. 17)
Right to correct inaccurate personal data (Art. 16)
Right to receive data in a machine-readable format (Art. 20)
Right to object to processing of personal data (Art. 21)
Right to restrict processing of personal data (Art. 18)
Public portal
Give data subjects a dedicated portal to submit requests. The portal is customizable with your organization's branding and generates a shareable link you can add to your privacy policy. The portal starts switched off: it goes live when an owner or administrator switches on "Public form active" in the rights-request settings, and that switch is recorded in the activity log. Until then, anyone who opens the link sees your privacy contact.
Portal URL
https://app.privacycloud.com/dsar/your-org-slugShare this URL in your privacy policy so data subjects can submit requests directly. The portal includes a consent checkbox and privacy notice explaining how their data will be handled.
Portal configuration
Task management
Break down each DSAR into actionable tasks and assign them to team members. Track progress, add notes, and ensure nothing falls through the cracks.
Example Tasks for an Access Request
SLA tracking
The system automatically calculates SLA deadlines based on your applied jurisdictions. Deadlines are per-framework: GDPR (one month, extendable by two further months where necessary), CCPA/CPRA (45 days, extendable once by a further 45 days where reasonably necessary), LGPD (15 days), and 40+ others. Reminder emails go out 7, 3 and 1 day before the deadline and once when it is overdue. Where the law allows an extension, the Extend deadline button on the request applies it once and records your reason.
15-45
days by jurisdiction
Auto
deadline calculation
Alerts
approaching & overdue
Data retention & auto-Redaction
PrivacyCloud automatically redacts personal data from completed DSAR records after the configured retention period. This ensures the platform does not become a risk vector for the organizations it serves.
Request completed
DSAR fulfilled
Retention period
30 days after closing (hosted); 90 by default (self-hosted)
Auto-Redaction
PII replaced
Anonymized record
Stats preserved
What gets redacted
- Requester name, email, phone
- Request description and details
- Communication content and attachments
- Task data exports and notes
What is preserved
- Request type (Access, Erasure, etc.)
- Status and SLA dates
- Audit trail (actions + timestamps)
- Aggregate statistics for reporting
Performance report (PDF export)
Export a DSAR Performance Report as a polished PDF for regulators, auditors, or board presentations. The report contains only aggregated metrics: no individual personal data.
Report sections
Processing a DSAR request
Receive request
SystemA data subject submits a request through the public portal (with consent) or you create one manually in Rights requests.
Verify identity
Privacy officerConfirm the identity of the data subject. Update the request status to reflect the verification outcome.
- •Request additional ID documents if needed
- •Mark identity as verified or rejected
Create and assign tasks
Privacy officerBreak the request into tasks and assign them to the relevant team members.
Collect and review data
TeamTeam members search systems, compile data, and upload findings. The privacy officer reviews for completeness.
Deliver response
Privacy officerSend the final response to the data subject and mark the request as completed. PII will be auto-redacted after the retention period.