Understanding Data Subject Requests (DSRs) & Data Subject Access Requests (DSARs)

Understanding Data Subject Rights & Privacy Compliance: Personal Data Rights That People Have Under Data Privacy Laws (Right of Access, etc.)

Modern data protection laws mirror many General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA) principles regarding consumer rights to data privacy, such as the right of access. While these rights are common across many regional and state privacy laws (like those in California, Colorado, Connecticut, Utah, and Virginia), specific definitions, exceptions, and implementation requirements vary by region. However, generally most common rights guaranteed to consumers in privacy laws include rights around personal data/information:

• The right to access personal information. Consumers can request copies of the personal data that a business has collected about them.
• The right to delete personal information. Consumers can request that businesses delete their personal data, though this often comes with exceptions.
• The right to correct inaccurate personal information. Some laws allow consumers to request corrections to their data.
• The right to opt-out of the sale or sharing of personal information. Consumers can direct businesses not to sell or share their data with third parties.
• The right to data portability. This allows consumers to obtain their personal data in a format that can be transferred to another service.

What is a Data Subject Request (DSR)? What are Data Subject Access Requests (DSARs)?

Commonly known as a Data Subject Request, a DSR is a formal request through which an individual (the "data subject") can exercise their rights to access, review, and delete or correct the personal information that an organization holds about them. This data includes any relevant information the organization has collected, stored, or processed about that person.

Some people often use the term Data Subject Access Request (DSAR) interchangeably with DSR. However, a DSAR technically only refers to a person's right of access to their personal data, whereas a DSR encompasses their right to access, review, change, and delete their information.

From a legal and risk perspective, DSR response and management are critical for compliance with data privacy laws and important for overall consumer data protection. Efficient and timely handling of privacy requests demonstrates transparency and can help build customer trust and loyalty.

Managing the DSR & DSAR Process: Key Challenges for Small Teams

Small teams without dedicated staff for managing DSRs/DSARs may face some challenges, including:

• Limited resources. Small businesses often operate with tight budgets and may be unable to hire dedicated staff for handling DSRs/DSARs, data processing, and other aspects of data privacy. Even with existing staff, competing priorities may exist, and there may be a sense that privacy is non-essential.
• Lack of specialized privacy expertise. Within existing staff resources, small teams may face knowledge gaps regarding the complexity of state-by-state and international privacy regulations, such as CCPA/CPRA and GDPR, and a rapidly changing legal landscape. Small companies may also face challenges identifying all data storage locations, understanding data flow, and managing cross-system data retrieval.
• Time constraints. Even if small teams can dedicate resources to handling data subject requests, most privacy laws have strict timelines that require balancing workloads and may interrupt regular business workflows.
• Risk of non-compliance penalties. If small businesses can't effectively manage DSRs, they face significant monetary penalties for non-compliance with data protection laws, potential legal challenges, and loss of customer trust.

While these challenges may be significant, they're not insurmountable if you have the right approach and tools.

Step-by-Step: How to Enable People to Submit a DSAR or DSR & Managing the DSR and DSAR Response Process

1. Establish a Clear DSR & DSAR Intake & Response Process

• Create a standardized method for DSR/DSAR submission, such as a dedicated email address or an online form.
• Design a simple intake form with the required information, including name, contact details, and the type of request (access, deletion, correction). Use plain language and include a short description of how the request will be handled.
• Establish identity verification protocols, such as two-factor verification or security questions.

2. Create Efficient Workflow Templates for the DSR/DSAR Process

• Develop standardized templates for responding to DSRs/DSARs, such as an initial acknowledgment email, progress updates, and final response templates for the requested information.
• Assign roles and responsibilities, even in small teams, and set clear task timelines.
• Create an internal checklist to ensure the process is complete. This checklist can include request receipt and logging, identity verification steps, the data search and collection process, review and redaction requirements, a quality check before sending, and response delivery confirmation.

3. Data Mapping and Retrieval Strategies

• Document all data collection points (website forms, email marketing systems, CRM platforms, HR systems, customer service platforms, etc.), categories of personal data, and create visual data flow diagrams.
• Establish a central data repository, implement consistent naming conventions, create standardized folder structures, set up access controls and permissions, define data retention periods, document backup procedures, and implement search capabilities.
• Establish data location tools, such as database query templates, file system search procedures, email archive search tools, and cloud storage search methods.

4. Compliance and Documentation

• Develop and track request timelines, such as:
  • Day 1: Log the request and send an acknowledgment
  • Days 2-5: Complete identity verification
  • Days 6-20: Data collection and processing
  • Days 21-25: Review and prepare a response
  • Days 26-30: Final quality check and delivery
• Maintain proper documentation, such as identity verification records, search parameters used, data provided/withheld, redaction decisions, and timeline of actions.
• Develop internal record retention schedules and protocols (how long to keep DSR/DSAR records, secure storage requirements, access controls, and deletion schedules).

Leveraging Technology for Success & Compliance with Privacy Laws

If this still seems daunting, the good news is that data privacy technology can transform these challenges into manageable, streamlined processes. Concord's next-generation privacy platform unifies consent management, privacy requests, policy generation/management, and data mapping to help you build trust, accelerate growth, and ensure absolute compliance with evolving data privacy and AI regulations, including GDPR, CCPA/CPRA, LGPD, the EU AI Act, and many more. Learn more at concord.tech.

‍