One data subject access request is a task somebody does. A stream of them is a process, and the transition catches companies out because nothing announces it. The signs are a second request arriving before the first is closed, and somebody asking how many are open. This page is what changes.
An intake rule instead of an intake person
While requests are rare they reach the one person who knows what to do. At volume that person becomes the bottleneck and, when they are on holiday, the failure. The replacement is a rule everybody knows: anything that looks like a request goes to one address today, with the date it arrived.
A systems list that is maintained, not rediscovered
Rediscovering where personal data lives on every request is the largest avoidable cost in the whole process. Written once and maintained, the list turns a two-day search into a two-hour one, and it is the same list the record of processing needs.
A template response, with the parts that always differ marked
Most of a response is identical every time: what was searched, the context Article 15 asks for, what was withheld and why. Templating it removes the risk of a rushed answer omitting the context, which is the most common complaint about an otherwise correct response.
A register, because open counts matter
At volume the question stops being how do I answer this and becomes which of these is closest to its deadline. That question needs a register with a receipt date and a due date on every row. A spreadsheet does this until somebody forgets to update it, which is usually the point people move.
Questions people ask about dsars
At what volume does this become necessary?
Sooner than expected, because the trigger is not the count but overlap. Two open at once is enough to need a due-date view; ten a year is comfortably past the point where a shared inbox is a risk.
Can requests be batched?
Not in their deadlines, which run individually from each receipt. The searches can genuinely be batched where the same systems are involved, and that is where the saving is.
What does a regulator look at?
Whether responses went out inside the deadline, and whether you can show it. A register with receipt and sent dates answers both in one screen, which is why it is the artefact worth building first.