Contact

Data Subject Access Requests (DSARs)

Know exactly what to do when a DSAR lands.

A data subject access request can arrive at any time, from anyone, in any format. Your business has one calendar month to respond. Most organisations treat DSARs as a legal problem, but in practice, your ability to respond on time depends almost entirely on how well your IT environment is set up. 

We help businesses build the systems, documentation, and processes that make DSAR compliance a structured, repeatable task rather than an expensive scramble.

Close-up of hands typing on a laptop in a dark office setting. Perfect for business and technology themes.
Focused workspace with business charts and laptop for financial analysis.

What Is a DSAR?

Article 15 of the UK GDPR allows individuals to request copies of their personal data. Requests can be informal (e.g., an email) and don’t require specific terminology. The one-month deadline starts once identity is verified.

Anyone, staff, clients, or the public, can submit a DSAR. While there’s no frequency limit, excessive requests may be refused or charged for if justified to the ICO.

Key Facts:

  • Deadline: One calendar month
  • Format: Any channel (email, phone, social media)
  • Cost: Usually free
  • Extension: Up to two months for complex cases
  • Penalties: Fines and reputational damage

For more on the Data (Use and Access) Act 2025.

How Dr Logic Helps Businesses Get DSAR-Ready

We help UK businesses built the IT foundations that makes DSAR compliance manageable. That means practical, hands-on work, not theoretical advice.

Data Landscape Mapping

We audit your systems to identify everywhere personal data is stored, processed, or transmitted, so your team is working from a map, not a guess.

  • Email, file storage, chat, CRM, HR, finance, and cloud platforms.
  • Device-level data on managed Macs, iPhones, and iPads.
  • Search capability and limitations documented for each system.
  • Admin access requirements confirmed and recorded.

DSAR Process Documentation

We help you build a documented, repeatable response process that becomes part of your wider IT policy framework.

  • Named DSAR lead and backup, with a clear escalation path.
  • Step-by-step search, redaction, and secure sharing procedures.
  • Folder structure template for evidence and audit trail.
  • Acknowledgement and identity verification templates.

Platform-By-Platform Search Guidance

Every platform handles data retrieval differently. We provide clear, step-by-step search instructions for the specific tools your business uses.

  • Google Vault, Egnyte, Zoom Chat, Microsoft 365, and others.
  • Search terms, date ranges, and export formats documented per platform.
  • Workarounds for platforms with limited or no admin search capability.
  • AI-assisted search options for high-volume data (e.g. Claude Cowork for Zoom Chat logs).

Apple Environment Configuration

For Mac-first businesses, we ensure your Apple environment supports DSAR compliance.

  • FileVault recovery keys escrowed centrally via MDM.
  • Managed Apple Accounts separating work and personal data.
  • Enrolled devices visible and auditable through Apple Business.
  • Business data routed through searchable, centrally managed platforms.

Ongoing Review

DSAR processes need updating when systems change, new platforms are introduced, or legislation is updated.

  • DSAR readiness included in annual security policy reviews.
  • Quarterly business reviews to check documentation is current.
  • Updates aligned with legislative changes, including the Data (Use and Access) Act 2025.

Apple-Specific DSAR Challenges

Apple’s privacy focus provides strong protection through FileVault and MDM, but limits device-level searching. Compliance requires platform-level searches across email and cloud tools. Risks include inaccessible data on personal devices and being locked out if FileVault keys aren’t centrally escrowed. Proactive setup is essential to avoid complications during live requests.

Two Apple MacBook laptops sit on a desk; one is open displaying a colourful screen related to data privacy, and the other is closed showing the Apple logo. Headphones, a plant, and decor are also visible in this modern workspace setting.

Who Needs DSAR Support?

DSAR Readiness for Every Stage of Growth

Man with a beard using a tablet at a desk, next to a laptop. Another person works in the background. Office environment with phones and water bottle visible.

For Growing Businesses

10 – 50 Users

You probably do not have a dedicated compliance team. DSARs may arrive infrequently, but when they do, you need to respond confidently without pulling people away from other work for days.

  • A named DSAR lead and a clear escalation path for your team
  • A documented list of systems where personal data lives
  • A repeatable search and response process ready to follow when a request lands

Mid-Market and Scaling Businesses

50 – 250 Users

More staff, more systems, more data. The larger your organisation, the more platforms a DSAR search needs to cover, and the more important it is to have a consistent, documented process.

  • A full data landscape map covering every platform and system in use
  • Standardised search methodology with platform-by-platform guidance
  • DSAR readiness built into your wider IT governance and policy framework
Three people are seated around a desk in a modern office, discussing governance and compliance strategies in front of two computer monitors. other individuals are visible in the background.
Two people working on laptops at a wooden desk in an office setting, focused on ensuring compliance. one person is gesturing toward their screen while discussing a governance strategy. a blurred reflection is visible in a glass panel.

Regulated and Compliance-Conscious Businesses

If your business operates in a regulated sector, responds to security questionnaires, or needs to demonstrate GDPR compliance to clients and partners, a documented DSAR process is not optional, it is something your stakeholders will expect to see.

  • A DSAR process documented to audit-ready standard.
  • Evidence of “reasonable and proportionate” search methodology, as required by the DUAA.
  • Complaint-handling procedures aligned with the June 2026 requirement.

Not Sure If You’re DSAR-Ready? Let’s Find Out.

One conversation could save you from a missed deadline and an ICO complaint.

FAQs

What happens if we miss the one-month DSAR deadline?

The individual can complain to the ICO, which may investigate and require you to respond by a set date. In serious or repeated cases, enforcement action is possible, including fines. More commonly, missing the deadline simply damages trust with the person who made the request. The best protection is having a documented process in place before a request arrives.

Do we have to search every system in the business?

Not necessarily. The Data (Use and Access) Act 2025 confirms that organisations must conduct “reasonable and proportionate” searches rather than exhaustive ones. However, you need to be able to justify what you searched and what you excluded. A documented data map and a recorded search methodology for each DSAR is the best way to demonstrate compliance.

Can Apple MDM help us respond to a DSAR?

Apple’s MDM gives IT managers visibility over enrolled devices, installed apps, and security policies like FileVault encryption. However, MDM cannot search the contents of a device for a specific individual’s data. DSAR searches need to happen at the platform level – through your email provider, file storage, and chat tools – rather than through device management alone. Read our full guide to DSARs and Apple.

Related Articles

Clear, Actionable Advice – No Jargon, No Pressure.

Get In Touch With an IT Expert

Scaling up, tackling downtime, or reviewing your setup? Contact us or book a quick call for expert advice on running your IT smarter and more securely.

Rather speak to us right now? Our phone number is: 020 3642 6540


Contact Form

You can unsubscribe from these communications at any time. To learn more about how to unsubscribe and how we protect your personal data, please see our Privacy Policy.

Book a Consultation Form

You can unsubscribe from these communications at any time. To learn more about how to unsubscribe and how we protect your personal data, please see our Privacy Policy.

Want IT to Work Smarter for You?

Get expert tips, security advice, and practical insights for Apple and hybrid teams – straight to your inbox.


Subscription Form

You can unsubscribe from these communications at any time. To learn more about how to unsubscribe and how we protect your personal data, please see our Privacy Policy.

ContactClient Portal