DSAR Management

Data subjects choose a requester type - Customer, Representative, or Third Party - and a request type covering Access, Rectification, Erasure, Restriction, Portability, Objection, or Consent Withdrawal, then fill a dynamic template-driven form and upload supporting documents. 

Every public submission is gated by an email one-time-passcode check before the request enters the workflow, and requesters can revisit their submitted request - to view, edit, or withdraw it - using their reference number. 

A single case moves through an explicit pipeline: intake review → identity verification → legal review → data-owner assessment → a legal second review → DPO final review → response dispatch → closure - with a dedicated screen and matching read-only preview at every stage. 

A distinct post-fulfilment stage lets Legal check the compiled response for redactions and exemptions before it goes back to the data owner or forward to closure, catching disclosure risk before it leaves the organization. 

Every request carries a default 30-day SLA deadline, with support for formal extensions - reason, extended deadline, extension date - a live compliance status, pre-breach warning notifications, and an automatic escalation flag driven by a scheduled monitoring job. 

A separate verification record tracks verification level, method, status, notes, and which DPO verified the requester, in addition to the OTP check performed at public intake. 

Legal sign-off and DPO sign-off are tracked as distinct fields, each with its own status and date, so accountability for the final response is never ambiguous. 

A signed, regulator-ready PDF closure report is generated automatically on case closure and stored permanently against the case, ready for hand-off without manual assembly. 

Dedicated screens exist for intake review, identity verification, data-owner assessment, legal review, and data-owner submission - each with a matching read-only preview, so any reviewer can see exactly what a case looked like at any earlier stage. 

Data subjects can upload supporting documents at intake, and internal reviewers can attach notes and evidence at each stage, keeping the full case file - not just the final answer -available for audit. 

A requester can withdraw a case at any point using their reference, and an intake reviewer can mark a submission invalid - both outcomes are logged and reportable in the same way as a completed case.