Are you having trouble handling data subject access requests (DSARs)? Don't fret — you're definitely not alone. DSARs can be complex and time-consuming to deal with. Fortunately, this short 'n' simple primer is here to help!
In this guide, we'll cover everything from what a DSAR is and who submits them to how you should respond and the common challenges you'll encounter. We'll also answer one of the most elusive questions surrounding DSARs: Can they be automated? Let's dive right in.
What Are Data Subject Access Requests?
The global digital landscape is rapidly evolving. In an effort to bolster data transparency and privacy, the General Data Protection Regulation (GDPR) granted EU residents and anyone doing business with EU organizations new rights regarding how organizations collect and process consumer personal data. The California Consumer Privacy Act (CCPA) and the more recent Virginia Consumer Data Protection Act (VCDPA) established similar obligations.
One of these rights is called the right of access. his right empowers individuals (“data subjects” under GDPR) to submit a request known as a data subject access request to learn what information your organization has about them and how you use it. Besides discovering or accessing their personal data, subjects can also use DSARs to request correction or deletion of their personal data.
Recent data privacy regulations like the GDPR and CCPA have increased the power of consumers to make these requests, and the risk to companies of fumbling them. While this development certainly improves transparency for consumers, it also creates challenges for companies around the world.
Who Can Submit DSARs?
Anyone can submit a DSAR at any time. This includes but is not limited to customers, users, sales prospects, employees, contractors, job candidates, and donors. Individuals do not need to supply a reason for submitting a DSAR, and organizations can only ask questions that help verify the subject's identity or locate the requested data.
Individuals can also submit DSARs on behalf of others. Here are some examples of when this can occur:
- A parent or guardian requests information on a child.
- A court-appointed individual is in charge of handling someone else's affairs.
- A contractor or employee requests data on behalf of their client or employer.
In these cases, it's imperative to verify that the person submitting the DSAR is genuinely doing so on behalf of the data subject. Organizations can do this by requesting supporting evidence of their relationship (e.g., birth certificates, power of attorney documentation, etc.).
What's Required in a DSAR Response?
DSARs usually request a copy of all personal data you have on a data subject. Sometimes, the subject may only request specific details. Either way, you're obligated to provide any data that is relevant to the request.
Here are some examples of the information that data subjects can request:
- Confirmation that your organization processes their personal data.
- Access to a subject's personal data.
- Your lawful basis for processing the subject's data.
- How long you'll store their data.
- How the data was obtained and how it's used in automated decision-making and profiling.
- Third parties with whom you share the subject's data.
How Do You Respond to Data Subject Access Requests?
Generally speaking, you must take four steps to process and fulfill DSARs.
1. Register, Record, and Authenticate the DSAR
Before your organization starts fulfilling a new DSAR, it should register the request, log it in a record system, and authenticate the user making the request.
2. Gather Personal Data
Next, you must discover and categorize the subject's personal data that you process and store.
3. Review the Personal Data
After collecting the subject's personal data, review or redact it to ensure that it meets DSAR requirements without disclosing any proprietary information or data of other subjects.
4. Deliver the Data Securely
Once you've completed the previous three steps, you can now deliver the information to the data subject. Make sure you do this as safely as possible — data breaches or leaks can be extremely expensive, both in money and reputational damage.
How Long Do You Have to Respond to DSARs?
Under the CCPA, you must respond to a DSAR within 45 days. The GDPR only gives you 30 days to do so. Although both laws offer extensions in certain cases, failure to respond to a DSAR within the proscribed timeframes can result in substantial fines and regulatory penalties. It can also damage your organization's reputation by suggesting that you don’t value transparency.
Why Are DSARs So Challenging to Fulfill?
DSAR orchestration involves a complex workflow of verifying the request, finding the data, reviewing it, and delivering it to the subject. Bringing automation to the process would be a boon for organizations, but it’s easier said than done due to the following complexities:
Personal Data Can Exist Across Multiple Systems
Depending on the size of your organization, DSAR orchestration can encompass dozens, or even hundreds, of systems that collect and store information. This means you have to go through all of the steps mentioned above for each system your organization relies on — in-house legacy, cloud-based, data warehouse, and third-party — to fulfill the request.
This factor alone can exponentially increase the complexity of completing a single DSAR. Consequently, fulfilling DSARs can quickly become both time- and labor-intensive, costing you much more money and resources than you had originally envisioned.
The bottom line? If you don't keep all of a subject's personal data in one convenient place, you'll probably have to implement a data mapping process to keep track of everything and rely on a reporting tool to pull this information from several resources to generate a DSAR response efficiently.
No matter what business you’re in, this is a common conundrum you're likely to encounter. Personal data about your customers resides in more places than just your CRM — it's also in your financial and customer service systems, data logs, backups, websites, and many more locations across the cloud.
Personal Data Can Exist In Multiple Formats
Besides existing in multiple systems, personal data also comes in multiple identifier formats, such as names, email addresses, accounts, and cookies, just to name a few. To make matters worse, your customer may be John Smith in one system, cookie AU9AtlDpEbAqfakUE in another, and reward member #59420392 in yet another. Before you can even think about fulfilling or automating DSARs, you need to be able to find and align all of this data--a heavy lift.
For example, let's pretend you've received a DSAR based on an email address. If this isn't the system identifier, you'll need to request more information from the data subject or try to figure out the correct data format by delving into your system. The latter option isn't always available since some systems only hold obscure identifiers. Without this information, not only is automation impossible, but your compliance is now at risk.
Current Tools Are Inadequate
Even if you can locate all of a data subject's information, fulfilling the DSAR requires you to know and implement all of the steps of your workflow for each system. Tools like ticketing systems have proven to be valuable in helping customer service and IT help desks organize their workflows. And many have even added support for managing GDPR and CCPA DSARs. But they can only automate part of the process.
Ticketing systems can take care of tasks like ticket creation, receipt acknowledgment, and due date alerts. But they can't find, delete, or change all of the formats of a subject's personal data across all of your systems — that task falls to you. In other words, your ticketing system can tell you what to do, but you're still on the hook to actually orchestrae the DSAR and ensure that every step you take satisfies GDPR and CCPA. This actually comprises the bulk of complexity, time, and effort within your DSAR response workflow.
Regardless of the ticketing solutions, spreadsheets, and documented procedures you employ to streamline your DSAR response workflow, the actual process required to account for, modify, or remove personal data from each of your systems will still be manual to a significant degree.
So can DSAR orchestration ever be truly automated? Luckily, that's exactly what Ketch is for.
True Automation for Your Data Subject Access Requests
GDPR and CCPA compliance doesn't only let you avoid penalties; it's also a prime opportunity to establish and build trust with your customers. Quick, efficient responses to DSARs can elevate your brand by showing your clients that you take their data privacy seriously. But as you now know, accomplishing this isn't an easy feat.
If you're wondering if there's a better way to automate your DSAR response workflow, Ketch has got you covered. We built our platform from the ground up to automate the fulfillment of data subject access requests. And when we say "fulfillment," we really mean your entire workflow — not just ticket creation.
Want to remove compliance headaches and avoid hiring a costly data compliance analyst? Robust, automated DSAR orchestration is just a few steps away. Click here to schedule your Ketch demo and learn how our platform can simplify your DSAR response workflow.
To learn more about Ketch's innovative approach to Privacy Orchestration, download our white-paper here.