Why Data Subject Access Requests (DSARs) Present Ongoing Operational Challenges

Data subject access requests (DSARs) produce ongoing operational challenges for organizations across the United Kingdom (UK) and the European Union (EU). As request volumes increase under the General Data Protection Regulation (GDPR) and UK GDPR, legal, human resources, and compliance teams must adhere to strict deadlines while managing growing data complexity and regulatory expectations, writes Mark Anderson in an article for Relativity.

Anderson explains that DSAR obligations extend beyond European organizations, applying to any company that processes the personal data of UK or EU residents. Requests are being used in employment disputes and workplace investigations as well as more strategically during organizational change. These factors have elevated DSAR management from a narrow compliance responsibility to a broader operational priority with significant cost and resource implications.

A major obstacle is the changing nature of enterprise data. Organizations must now search across collaboration platforms, customer service systems, mobile messaging applications, personal devices, voice recordings, video files, scanned documents, and handwritten notes. Locating, reviewing, and redacting personal information across these diverse sources requires workflows that remain accurate, efficient, and defensible under regulatory scrutiny. 

Traditional, manual DSAR processes are no longer sustainable. Legacy technology, labor-intensive reviews, inconsistent redactions, rising outsourcing expenses, and demanding one-month response deadlines have exposed the limitations of older approaches. As organizations confront larger datasets and more frequent requests, scalable workflows have become increasingly important.

Because DSARs are ongoing operational challenges, organizations are adopting AI-assisted review, analytics that reduce irrelevant data, automated duplication, optical character recognition, and audio and video transcription. According to Anderson, successful DSAR programs depend on combining automation with expert oversight, enabling organizations to manage growing request volumes efficiently while meeting regulatory demands, and controlling operational costs.