How to Build a DSAR Workflow That Doesn't Break at Scale
Why most DSAR failures are really data-mapping failures, and the six steps of a workflow that holds up when requests arrive in volume.
8 min read
A single data subject request is easy to handle by hand. Fifty a month is not. The teams that drown are usually the ones treating each request as a one-off search rather than running a defined workflow. Here is what a workflow that scales looks like, and the one thing that decides whether it works.
The Six Steps
- Intake. A single, structured way for requests to arrive, a form, not scattered emails, so every request captures who is asking and what they want.
- Verify. Confirm the requester is who they claim to be, calibrated to how sensitive the data is (see identity verification).
- Locate. Find the person's data across every system that holds it. This is the step that makes or breaks the timeline.
- Act. Perform the right action on the located data: produce a copy, delete, correct, or export.
- Respond. Deliver the result within the legal deadline, and notify the requester of any extension before the original window closes.
- Log. Keep a record of what was requested, what you did, and when. Your audit trail is your defense if the response is ever questioned.
The Step That Actually Breaks: Locate
Most DSAR failures are data-mapping failures. You cannot produce, correct, or delete data you cannot find, and personal data has a way of spreading, into the product database, the data warehouse, the support tool, the email marketing platform, and a dozen SaaS apps. If locating a person's data means asking five teams to go look, you will miss deadlines as volume grows.
The fix is to know where personal data lives before a request arrives. A current data map turns "locate" from a scramble into a lookup, which is what lets the rest of the workflow run on time.
How Concord Fits
Concord Privacy connects request intake and identity verification to data mapping, so a verified request routes to the systems that hold the person's data and moves through the steps above as one tracked workflow. The map does the locating; the workflow keeps the clock and the audit trail.