DSAR management software — structured intake, guided processing, auditable delivery

DSAR automation software reduces the manual work between intake and delivery. In Acompli that means structured portal intake, duplicate detection during identity verification, task routing to system owners, deadline clocks with extension records, and AI that scans collected documents for PII entities and proposes redactions. Every proposal is reviewed by a person, and nothing is released through the requester portal without human approval.

SLA tracking holds every request against its statutory clock: received date, the Article 12(3) one-month deadline, any two-month extension with the reason recorded, task owners, blockers and completion date. Acompli tracks deadlines for GDPR and UK GDPR alongside CCPA, LGPD, PIPEDA and POPIA timelines, so one queue shows the privacy team everything approaching its date.

Disclosing personal data to the wrong person is itself a data breach the DPC or ICO can act on. Acompli records how each requester was verified and when, runs duplicate detection against earlier requests, and only releases a request into processing once verification is complete - so the audit trail shows the check happened before any data moved.

Redaction removes or withholds what should not be disclosed: third-party personal data, privileged material and out-of-scope content. In Acompli, AI scans the collected documents for PII entities and surfaces each finding for review; a person confirms, rejects or refines every redaction before the response is approved for delivery, and the decisions stay on the request's audit history.

The full story of the request: intake channel and dates, identity checks, scope decisions, the systems searched, documents collected, redactions with reviewer decisions, approvals, delivery evidence and closure notes. Acompli generates this as the request's closure record, exportable when the DPC or ICO asks how a response was produced.

Yes. In Ireland the obligation sits in GDPR Article 15 as enacted under the Data Protection Act 2018 and is enforced by the Data Protection Commission. In the UK the same obligation sits in UK GDPR Article 15 and the DPA 2018, enforced by the ICO. Both regulators require a response without undue delay and within one month of receipt (GDPR Article 12(3)), with a permitted two-month extension for complex or numerous requests provided the requester is informed of the extension and the reason within the first month. Failure to respond, or to evidence the response, is a recurring source of DPC and ICO enforcement action.

Choose by the record the workflow leaves behind. A useful DSAR tool should capture intake and identity checks, track the one-month clock and any extension reason, search the source systems where data lives, keep redaction decisions under human review, and preserve delivery evidence. Acompli DSAR is built around that lifecycle and can run GDPR, UK GDPR, CCPA, LGPD, PIPEDA and POPIA requests on one queue.

Under the Data Protection Act 2018 (Ireland) and the UK GDPR / DPA 2018, controllers must operationalise GDPR Article 15. Practical automation covers the lifecycle, not the legal judgement: a public portal can capture the request and identity evidence, discovery can run across HubSpot, ServiceNow, Microsoft 365, Jira and custom connectors, AI can flag PII in collected documents for review, the deadline tracker can support Article 12(3) extensions, and the workflow can preserve a request-level audit trail. Decisions on exemptions, third-party data and disproportionate-effort assertions remain with the data protection officer or reviewer.

Following Schrems II (CJEU C-311/18) and the DPC’s €1.2bn Meta decision, controllers must know where personal data is processed before fulfilling a SAR that touches non-EEA systems. DSAR software should expose the hosting location of each connected source, flag third-country destinations the request would draw from, and let reviewers attach the relevant transfer mechanism (SCCs plus supplementary measures, an adequacy decision such as the EU-US Data Privacy Framework, or a derogation). The request-level audit should record which third-country systems were searched, what was retrieved, what was withheld, and the transfer basis applied — so the DPC can see the controller’s reasoning. For the full Schrems II methodology — SCCs plus supplementary measures, adequacy and the EU-US Data Privacy Framework — see our Transfer Impact Assessment guide.

Yes. Irish public bodies receive both GDPR Article 15 subject access requests (regulated by the DPC under the Data Protection Act 2018) and Freedom of Information requests under the FOI Act 2014 (regulated by the Office of the Information Commissioner). Acompli runs both on the identical request lifecycle: portal intake, identity verification, parallel discovery across connected systems, AI-assisted PII detection with human-reviewed redaction, deadline tracking, response approval and auditable delivery. The two regimes differ in legal tests and timelines — the workflow surfaces that difference rather than collapsing it — but the operational backbone is one product.

A SAR is an evidence event for the Article 30 RoPA: it tells the controller which systems actually held the requester’s personal data, which categories were retrieved, which retention rules fired, and which third-country systems were searched. When DSAR runs alongside the Acompli compliance platform, the search trail and connector inventory used to fulfil a request can be reconciled against the Article 30 register — gaps surface as RoPA updates rather than living only in the request file. The DPC and ICO both treat a controller’s ability to find personal data on request as practical evidence that the Article 30 register reflects reality. For whether a RoPA is a legal obligation and what Article 30 must contain in Ireland and the UK, see our RoPA requirements guide.

AI scans collected documents for PII entities — email addresses, phone numbers, national identifiers, payment numbers, names, addresses — and surfaces each finding for human review. A reviewer confirms, rejects, or edits every detection; nothing is released to the requester through the secure portal without that human approval, in line with the DPC’s expectation that automated tooling supports but does not replace the controller’s decision. Each applied redaction is recorded with reviewer, timestamp, document and zone reference, and the reason category — including third-party personal data exemptions under GDPR Article 15(4) and Schedule 2 of the Data Protection Act 2018. The complete Evidence Pack carries the search trail, exemptions, redactions and approvals into the audit archive.

Yes. DSAR software, subject access request software, SAR software and data subject access request software all name the same category of tool: the one a privacy team uses to run a GDPR Article 15 right-of-access request from intake to delivery. The terms are used interchangeably. DSAR stands for data subject access request and SAR for subject access request; they are the same right, with the abbreviation more common in product names and the spelled-out forms in the legislation and regulator guidance. Acompli runs them on one workflow against the Article 12(3) one-month clock, whether you call it a DSAR, a SAR, or a subject access request.

The best DSAR software is decided less by how fast it drafts a response than by whether it tracks the Article 12(3) one-month clock and its two-month extension reliably, verifies requester identity before any data moves, searches every source system, and keeps a person accountable for each redaction and the release. Acompli's angle is to govern these as connected, human-approved records tied to the wider GDPR and EU AI Act programme, each redaction and release traceable to approved evidence. To compare DSAR suppliers even-handedly, our DSAR software comparison guide and full comparison library present public-source capability charts and vendor-by-vendor breakdowns, and are open about where competitors beat Acompli.