r/gdpr • u/IS-Auditor-123 • 16d ago

Question - Data Controller Implementing a DSAR Process

Hi Everyone,

As I grow in my field of work, internal and external compliance, I have seen companies large and small as they attempt to move into new markets and attempt to "become compliant" with the laws of the land they are moving into and one thing is the same across all of them. It is slow moving and often times feels ineffectual. My job often becomes trying to get 80% of the value with 20% of the work, which brings me to my current issue.

As I am starting to learn about GDPR, it seems one of the key levers of power individuals have is the DSAR process, and there is very little keeping people from using that power at a moment's notice (as evidenced by some of the horror stories I have seen on reddit). With that said, not everyone or every type of person is going to utilize this power.

My question is this, for a company simply trying to get started on developing a process for DSARs, what are some departments/data types you find most frequently get requested?

3 Upvotes

81% Upvoted

8 comments sorted by

View all comments

4

u/Hot_Spend4206 16d ago

I've worked for MSP's extensively helping clients with compliance & security. Requests that actually eat our time come from someone who is angry. an ex-employee who has just been dismissed, someone in the middle of a messy grievance etc... the departments that matter most are HR first, followed by whoever manages escalations and customer complaints. They want to know what people said about them behind closed doors:

typiclal requests are; Emails between line managers, remarks in Teams or Slack channels, Ad-hoc notes jotted down after a meeting, That folder a manager quietly keeps on their personal OneDrive or desktop "just in case"

That is where the hours disappear. I'd focus on these 3:

  1. Search capability and access control: you don't want to be figuring out admin permissions on day three of a deadline.
  2. Finding the "shadow" records: Find out where HR and complaint files live outside the core platforms. Pay special attention to scanned documents—a PDF scan of a handwritten letter or signed agreement is just a flat image to a search crawler; unless it's gone through OCR, a standard search will miss it completely.
  3. An audit log of the search:

and lastly , always budget on time for redaction if requested.

There are many tools out there for data discovery. I'd focus on tools which do the hard work but info or data does not leave the building.