Good data subject access request software tracks every deadline, centralises each request in one record, supports reasonable and proportionate searches, redacts under human control, records exemption decisions, and keeps a full audit trail. Ask vendors to demonstrate each of these with your own scenarios before you buy.
Most buyers compare feature lists. That is the weaker approach, because every vendor ticks the same boxes. The better approach is to ask questions that expose how a tool behaves under pressure: a complex request, a paused clock, a disputed redaction, or a regulator asking you to show your working.
This guide is for UK data protection officers and information governance leads at mid-market and public sector organisations. It sets out ten questions to put to any vendor, compares spreadsheets with a purpose-built platform, and explains what the ICO expects. For the step-by-step handling of a request, see our DSAR process hub.
Why do spreadsheets stop working for DSARs?
Spreadsheets and shared drives stop working for data subject access request management when volumes rise, requests span several teams, or you must evidence decisions. They store a list of cases but cannot enforce deadlines, control access to disclosure material, or record who decided what and why.
A spreadsheet is a sensible starting point. It is cheap, familiar and quick to set up. The problems appear later, usually under pressure.
Deadlines are calculated by hand, so a paused clock or an extension is easy to get wrong. Documents sit in shared folders with broad access. Redaction happens in separate tools, and the reasoning behind each decision lives in someone’s inbox.
The table below compares the two approaches on the points that matter most when you are deciding what to buy.
| Capability | Manual spreadsheets and shared drives | Purpose-built DSAR platform |
|---|---|---|
| Deadline tracking | Calculated and updated by hand | Calculated automatically, including extensions and paused clocks |
| Request intake | Emails and forms logged manually | Requests logged to a single record from each channel |
| Task allocation | Chased by email | Searches assigned to named teams with visible status |
| Redaction | Separate tool, separate file versions | Redaction within the case, with review before disclosure |
| Exemption decisions | Notes in documents or inboxes | Recorded against the case with the reason |
| Audit trail | Reconstructed after the event | Every decision, redaction and communication logged |
| Access control | Folder permissions, often broad | Case-level access for the people involved |
| Reporting | Built manually for each report | Live view of open, due and overdue requests |
What does the ICO expect from your DSAR process?
The ICO expects you to respond without undue delay and within one month of receiving a request. You may extend by up to two further months for complex requests or multiple requests from one person. You must also search reasonably and proportionately, and be able to justify your decisions.
These points come from the ICO’s right of access guidance, last updated on 8 December 2025.
- One-month deadline. The time limit runs from the day you receive the request, even if that day is not a working day. If the deadline falls on a weekend or public holiday, it moves to the next working day.
- Extension. For complex requests, or where one person has made several requests, you can extend to three months from the original start date. You must tell the person, with your reasons, within the first month. A request is not complex simply because you need clarification.
- Paused clock. The time limit pauses on the day you ask for clarification about the information requested, and resumes the day after you receive it. If you need proof of identity, the clock does not start until you have the information you asked for.
- Reasonable and proportionate searches. You must make reasonable efforts to find and retrieve the requested information. You need not search where the effort would be unreasonable or disproportionate, but you must be able to show why.
- Records. The ICO advises keeping a record of conversations about the scope of a request, the dates clarification was requested and received, and the reasons for any delay in asking.
Each of these points shapes the questions below. A tool that cannot show you a deadline, a paused clock or a search decision will not help you answer a complaint. Our DSAR scoping guide explains how to narrow a request safely.
Which 10 questions should you ask before buying data subject access request software?
Ask every vendor the same ten questions and ask them to demonstrate the answers using a realistic request, not slides. Score each response against your own requirements. The vendor that shows you the workflow, rather than describing it, is usually the one that will hold up in daily use.
- How does the system calculate and protect the deadline? Ask to see an extension applied, a clock paused for clarification, and a request received on a weekend. Check that dates are not edited without a trace.
- Can every channel feed one record? Requests arrive by email, web form, post and phone. Ask how each becomes a single case, and how related requests from the same person are linked. Ask too whether people can submit requests and receive disclosures through a secure portal instead of by email.
- How do you assign and track searches across teams? Ask how HR, IT, legal and service teams are given tasks, how you see who has responded, and what happens when someone does not.
- How does the tool help you document a reasonable and proportionate search? Ask where you record which systems were searched, which were excluded, and why. Ask whether the tool supports deduplication and search terms to narrow the review.
- How does redaction work, and who stays in control? Ask whether suggestions are reviewed before anything is removed, and whether the original is always preserved. See our DSAR redaction tool for one example of how this can work.
- How are exemptions recorded? Ask whether each exemption is linked to the specific content, with the reason, so a colleague can understand the decision later. Our exemptions guides explain the common ones.
- What does the audit trail capture? Ask for an export of a completed case showing decisions, redactions, communications and who made them.
- Where is the data hosted, and which security assurances can you evidence? Ask for hosting location, certification evidence, and whether your case content is used to train any AI model.
- What is the total cost? Ask what is included: users, modules, redaction, storage, support and training. Ask what changes as your volume grows.
- How will you get us live, and what happens to our existing cases? Ask who migrates open cases, how long it takes, and how you will retrieve your data if you leave.
Reporting belongs in this list too. Ask to see the view a DPO would show a board: open requests, requests nearing their deadline, and recurring pressure points.
How do you move from OneTrust or another large platform?
Moving from a large platform starts with deciding what you actually use. Many mid-market and public sector teams use a fraction of an enterprise suite. List the DSAR functions you rely on, check what you can export, and choose a tool that fits your volume, budget and team size.
Large privacy platforms are built for large, complex organisations. That is not a criticism. It does mean a team handling a modest number of requests may pay for, and maintain, far more than it needs. Dedicated DSAR management software can be a closer fit.
When teams look for a OneTrust DSAR alternative, the practical questions are usually the same:
- What can we export? Check whether case history, documents and decisions can be exported in a usable format.
- What must we keep? Decide whether to migrate open cases only, and archive closed ones.
- Who administers it? Ask how much configuration the tool needs and who on your team will maintain it.
- What does it really cost? Compare the full price, including users, modules and support.
- How quickly can we be live? Ask for a realistic timeline, including time for your own testing.
We make no claims here about any other vendor’s product. Verify every point in your own evaluation, using the questions above. Our OneTrust alternative page sets out how ProvePrivacy approaches this move.
How does ProvePrivacy help with data subject access request management?
ProvePrivacy is a data protection and information governance platform that includes DSAR software within its Incident Management module. It logs each request in one record, assigns searches, records exemptions, supports AI-assisted redaction and keeps a full audit trail.
The ProvePrivacy data subject rights product page lists these capabilities:
- One place for every request: access, erasure, rectification, restriction, objection and portability requests in a single record.
- Guided investigation: searches assigned to teams, with what has been found tracked.
- Scoping tool: assisted deduplication and search term support to narrow a review.
- Exemptions applied consistently: UK exemptions recorded with the reason.
- AI-assisted redaction: personal data highlighted and redacted, included for every client at no extra cost.
- Secure portal: secure, time-limited delivery of disclosures giving data subjects direct access to their files.
- Full audit trail: every decision, redaction and communication logged.
- Real-time dashboards: open requests, due dates and pressure points for the DPO and board.
Ready to see how it works?
Book a demo of ProvePrivacy to see how our data subject access request software handles deadline tracking, guided investigation, redaction and the audit trail on a realistic request. Bring your ten questions, and judge the platform on what it shows you.
Frequently asked questions
What is data subject access request software?
Data subject access request software is a system that logs, tracks and completes requests under the right of access. It manages deadlines, assigns searches, supports redaction and exemptions, and keeps an audit trail. It replaces spreadsheets and shared drives with a single controlled record for each request.
How long do you have to respond to a subject access request?
You must respond without undue delay and within one month of receiving the request. You can extend by up to two further months if the request is complex or the person has made several requests, but you must tell them within the first month. Clarification and identity checks can pause or delay the clock.
Do you need DSAR software if you receive few requests?
Not always. If you receive a handful of straightforward requests a year, a well-managed spreadsheet may be enough. Software earns its place as volumes rise, as requests span many systems, or when you need to evidence deadlines, searches and exemption decisions consistently.
Can DSAR software redact documents automatically?
Some DSAR software uses AI to highlight personal data and suggest redactions, but a trained person should review every suggestion before disclosure. The decision to apply an exemption is yours, not the software’s. Ask any vendor how review works and whether the original is preserved.
Is it difficult to switch DSAR software?
It depends on what your current platform lets you export and how many cases are open. Most teams migrate open cases and archive closed ones. Ask any new vendor who handles the migration, how long it takes, and how you would retrieve your own data if you left.
Sources
- Information Commissioner’s Office, “What should we consider when responding to a request?” (right of access guidance, updated 8 December 2025): https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request
- Information Commissioner’s Office, “How do we find and retrieve the relevant information?”: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information
- ProvePrivacy, “Data Subject Rights” product page (capabilities as listed): https://www.proveprivacy.com/incident-management/data-subject-rights/
