Announcing $50M Series B funding to further accelerate our rapid growth

View More

A Data Subject Access Request (DSAR) is the means by which individuals request that your enterprise discloses what personal data it holds on them and how you use or intend to use it. Submitting DSARs is one of the Data Subject Rights granted to consumers under data privacy laws such as the California Consumer Privacy Act (CCPA) and the European General Data Protection Regulation (GDPR). These laws not only give consumers awareness about their rights over their personal data but also provide the tools necessary to exercise them. An enterprise served with a DSAR is legally obligated to fulfill these requests within a limited timeframe to avoid non-compliance. This is why automating the processing of DSARs is necessary to respond within the aforementioned timeframe. So, let’s discuss the importance of DSARs, how they differ under CCPA and GDPR, and how your business can cost-effectively prepare for and automatically respond to DSARs, which are likely to increase substantially in a post-CCPA world.

Who Are the Beneficiaries of DSARs?

DSARs give consumers unprecedented control over their personal information stored by organizations, from access to data and requesting information on stored data to requesting information on the data safeguards the organization provides. With CCPA, consumers can request DSARs twice a year at no cost whatsoever.

For businesses, speedy and accurate fulfillment of DSARs substantially boosts their brand image while also ensuring compliance with CCPA regulations. However, some estimates put the cost of the fulfillment of each DSAR could be in the thousands, since it requires data gathering across a multitude of systems, putting them in one place, going through data records and compiling it all in a comprehensive report. Moreover, fulfilling each DSAR can take weeks. This is where a solution based on automation can be a potent weapon.


Example of a Data Subject Access Request


DSARs under CCPA vs. GDPR

While both CCPA and GDPR provide consumers with mechanisms to exercise greater control over their data, there are some fundamental differences between how much power a consumer has under each law. Let’s have a look:



How to Prepare for DSARs

Many expect that the number of DSARs received will increase significantly once CCPA goes into effect on Jan 1, 2020. So let’s explore what is required and how to prepare:

Responding to a Data Subject Request

Organizations have 45 days to respond and fulfill a customer’s data subject request, in a transferable electronic format. These obligations may vary depending on the customer’s request and how their information is handled.

Manage Deletion Requests

Deletion requests involve not only team members from within the organization, but also all third-party vendors and partners with whom the personal information has been shared.

Communicating with the Consumer

CCPA requires the disclosure of rights and communication about DSARs, as does the GDPR. The rights given to consumers under CCPA and GDPR are similar but not identical. This means that organizations will need to change their communication accordingly.



Responding to Data Subject Access Requests

The following are the steps required to process and fulfill a DSAR:

  1. Register, log and authenticate DSAR
    Organizations must register data requests, log them in a system of record, and authenticate the user before starting work on their fulfillment, either manually or automatically.
  2. Collect personal information
    For organizations to prepare for DSARs, they will need to discover and categorize the personal data they process and store. This data is often stored on an array of systems within an organization and externally as well. The personal data must also be mapped to the individual owner of that data to facilitate the processing of DSARs. Leveraging a People Data Graph can help streamline this process. The collection of this data must also be done in a safe manner to avoid additional data sprawl which could translate to greater liability.
  3. Review and approve the information
    After gathering the necessary information, organizations need to review the data and make sure it meets the DSAR requirements without disclosing proprietary information or the personal data of any other data subject.
  4. Safely deliver customer information
    The final response must then be delivered to the consumer securely. If a data breach or leakage occurs, it can cost as much as $750 per leaked record.

Here are several risks associated with fulfilling a data subject request you must watch out for:

  • Requesters cannot be trusted without authentication.
  • Managing deadlines is crucial to fulfilling DSARs.
  • Data scanning should be automated, and done in a way that does not replicate copies of the data
  • Data processing should be centralized in a safe workplace to avoid personal data sprawl
  • Consumer responses should be encrypted to avoid data breaches.
  • The activity must be tracked to keep a record for validating compliance
  • Data delivered to the wrong person can be catastrophic.

One important factor to consider is that using traditional means will do more harm than good. For example, using emails to deal with DSARs can be dangerous as the risk of data sprawl increases when sending and receiving data over a system that is not secure. Moving personal information in an unencrypted system increases the risk of data breaches. It takes an average of 196 days for an organization to pick up on a data breach, making it essential for enterprises to fortify and automate their systems to protect themselves from any data breach.

Key Takeaways

Here are some highlights:

  • DSARs are a mechanism by which consumers request access to their personal information held by organizations such as yours.
  • Responding to these requests presents several operational challenges.
  • Fulfilling DSARs will prove to be especially costly (average cost of $1,400 per each request when fulfilled manually)
  • A comprehensive DSR robotic automation solution can reduce cost and complexity and limit legal liability

Large organizations may have hundreds of millions of records about their consumers, often spread across an array of systems. Sorting this data and creating a data inventory to cope with DSARs is a challenging task that requires organizations to automate their current practices.

At, we have solutions that offer robotic automation, machine learning and secure cross-channel collaboration to help your business stay prepared for CCPA.

Next Steps

To learn more about automation and orchestration of data subject requests and how much time you can save, check out the video below or schedule a demo to see it live, in action!


If you’re reading this, you care about data privacy. Maybe you care about it in the scope of your job responsibilities, or perhaps you care about it personally: in the scope of your own personal life and technology use. But more likely than not, it’s a mix of the two.  This is why automation of privacy efforts – and PrivacyOps -- matters. Curious? Read on.

The cultural zeitgeist of data privacy awareness

We didn’t get here by accident. Governments around the world have not enacted data-centric regulations such as GDPR and the California Consumer Privacy Act (CCPA) out of the pure goodness of their hearts. These laws are largely in response to growing public and awareness and outcry over-exploitation of sensitive personal information: personal information that individuals feel they often have little choice in providing or controlling if they are to participate in modern society. Pick your favorite headline about a breach or data privacy violation; data privacy awareness is high and growing.

The research done by 451 Research also corroborates this. In one of our consumer survey cycles, we asked individuals how concerned they were about data privacy. A full 90% reported they were either “very concerned” or “somewhat concerned.” Only 1% reported they were “not at all concerned.”

That type of awareness is hard to ignore, and in the US, individual states are rapidly enacting legislation for data privacy and protection: following in the footsteps of California. But for businesses looking to comply with these regulations, the landscape is treacherous. Not only does California’s law – CCPA – have extraterritorial reach, but all of the individual state proposals for laws are slightly different, leading to balkanization of data privacy and protection standards in the US. Interstate organizations in the US, then, cannot sustainably approach each new regulation with an ad hoc “Whack-a-Mole” approach. They need privacy programs that are adaptable, scalable, and that leverage automation to execute data management tasks common to multiple regulatory frameworks.


Common denominators: identifying the key principles of data privacy

But what, exactly, is the common denominator across these increasingly diverse data protection and privacy mandates? It is often easier to get caught up in the individual nuances and “checkbox” requirements of each than it is to identify core underlying principles. Identifying differences can give the organization a deceivingly simple “to-do” list that misses the big picture. In reality, data privacy and data protection regulations fundamentally exist to protect the rights of individuals, and to protect the rights of individuals, organizations need full control of ALL the personal data in their possession.

Across data privacy and protection regulations, individuals are generally given the “right to know” and the “right to say no” with regard to their data. The right to delete personal data, the right to data portability, the right to reasonable security for personal data, and the right to be notified in the case of a data breach are also all very common. Again, organizations must have a very granular understanding of what personal data is in their possession and what is happening to it at all times if these basic rights are to be fulfilled. Not knowing is not an excuse.


Challenges with data privacy in the modern IT ecosystem

Unfortunately for businesses, data is more difficult to control and understand than ever before. Once personal data is ingested into an organization, it propagates into countless internal systems and data silos, and can make its way to dozens or even hundreds of third-party vendor systems that the original organization has limited control over. A growing number of end users demanding data within organizations also complicates the management of appropriate access and permissions.

And the diversity of the average business IT environment is simply staggering. According to 451 Research’s enterprise practitioner survey results, 72% of organizations that use the public cloud use more than one public cloud vendor, and a total of 8% used more than three public cloud vendors: an impressive feat considering only three public cloud providers dominate the market in the US. For organizations with 1,000+ employees, a full third – 33% -- report having more than 50 distinct departmental data silos. That’s a lot of disparate data sources to manage.

A data storm is brewing

These factors amount to a perfect storm. Growing public outrage and awareness, proliferating regulations, sprawling IT ecosystems, an expanding pool of self-service data consumers, and the intensifying enterprise pressure to extract maximum insight from all available informational resources.

We’re at the end of an era; gone are the days where “reactive” business functions such as compliance and data privacy could be at odds with more “proactive” enterprise insight initiatives such as analytics and data science. In an era of rapid disruption, organizations that want to survive must align their business objectives such that data privacy and protection is no longer a burden or cost center. Rather, it must be an accelerator for better data management architecture and practices which will benefit all stakeholders.


The operationalization of responsible data use

In this context, data privacy and protection efforts are deeply intertwined with the viability of the business and the ability to meet the needs and expectations of customers: particularly in the B2C space. So, it should go without saying that data privacy and data protection needs to be an ongoing, iterative, adaptable process rather than a project-based “checkbox” approach with a deadline. New regulations will always emerge; it is up to organizations to implement processes and technology that can support evolving needs rather than just the specifications of a single law.

Automation will be critical. There is no amount of human talent and effort sufficient to scale to the data management volume challenges within a typical modern organization. There is simply too much data to evaluate and protect. Capabilities such as automated detection of potentially-sensitive data sources, automated policy controls for data, automated control of data access rights, and automated fulfillment of data subject access requests (DSARs) are all possible and – increasingly – necessary.

The PrivacyOps concept and framework looks to operationalize data privacy practices across the organization, leveraging automation, so that not only compliance objectives can be met, but so that the friction of end user data access and leverage can be reduced. Better data management and data privacy controls, when implemented correctly, can actually free up data that was formerly locked away in silos. To the average business end user, such as a data analyst, an effective PrivacyOps program will be invisible and simply make access to appropriate data sources quicker and more seamless.


The PrivacyOps Framework

What does PrivacyOps look like? It is a framework, rather than a specific tool, that takes into account people, processes, and technology. Emphasis on automation of error-prone and high-scale tasks is a must. At its most rudimentary, it breaks down into the convergence of four basic “systems:”

  • System of engagement with those that have privacy rights
    How will the organization communicate securely and effectively, and acknowledge the shifting preferences, of its data subject and customer audience?
  • System of automation for fulfilling privacy requirements
    How will the organization automate the assessment of third-party risk, or delivery of data to those that request it, or appropriate and timely notifications in the case of a breach?
  • System of record, including privacy knowledge and analytics
    How will the organization actually demonstrate that its compliance initiatives have been consistent and robust, or learn from its past data privacy efforts?
  • System of collaboration among privacy stakeholders
    How will the organization enable diverse data-privacy stakeholders to communicate and collaborate effectively without exasperating personal data sprawl?

Success means a shift in perceptions and approach

It’s time to stop thinking of data privacy and data protection as a burden, a barrier, or a niche responsibility within the organization. Responsible use of data, and the data management practices that enable it, can benefit everyone: from those depending on high-quality information to those that depend on the trust of consumers to cultivate long-lasting, profitable relationships.

Yes, organizations will need to leverage automation and technology to achieve these objectives. But ultimately, the discussion needs to start with business stakeholders. Getting everyone in alignment should be the first step, and establishment of effective and adoptable processes should be next. Finally, appropriate technology tools should be considered, selected, and implemented.

Request a
Demo Today!

Request a
Demo Today!