Handling DSARs: spreadsheet, tool or consultant?

For a few routine requests a spreadsheet or a small tool is enough. For disputes, sensitive data or high volume, a consultant is worth the cost.

Every organisation under the GDPR has to answer access requests within the Article 12(3) deadline and with the content Article 15 requires [1]. How you organise that is up to you. Here is a fair look at three common ways: a spreadsheet, a dedicated tool such as DSAR Desk, and a consultant, DPO service or law firm.

What any method must handle

A record of each request with the date of receipt.
The one-month deadline, the end-of-month case, and any extension notice sent within the first month [1][4].
A proportionate identity check where there is reasonable doubt [1][2].
An answer with all Article 15(1) information and a copy of the data, with other people's data removed where needed [1].
Judgement calls: is a request manifestly unfounded or excessive, is an extension justified [1][3].

Side by side

	Spreadsheet	DSAR Desk	Consultant, DPO service or law firm
Cost	No extra cost if you already have the software	$49 one-time	Fees or a retainer; ask for a quote
Setup time	You design columns, formulas and letters yourself	Open the file and start logging	Onboarding with the adviser
Time per request	Your time, plus writing letters from scratch	Your time, letters prefilled	Less of your time, but you still collect the data
Deadline logic	Only as good as your formula; month-end dates are easy to get wrong	Built in, including month-end and the first-month extension check	Handled by the adviser
Data privacy	Depends on where the file is stored and shared	Offline, stays in your browser	Data is shared with a third party under a processing agreement
Legal judgement	None	None; it is not legal advice	Yes, this is what you pay for
Best for	Very few, simple requests	Small organisations with occasional, routine requests	Disputes, complex or sensitive cases, high volume

Spreadsheet

A spreadsheet is free if you already have it and fully under your control. For one or two simple requests a year it can be enough. The weak points are the ones the law cares about: a date formula that adds 30 days instead of one calendar month gives the wrong deadline at month ends, nothing reminds you that the extension notice must go out within the first month [1], and the letters still have to be written. If the file sits in a shared drive, the request log with personal data travels with it.

DSAR Desk

DSAR Desk is a single offline HTML file. You log the request, it calculates the due date including the end-of-month case, the extension button checks that you are still within the first month, and it prepares the acknowledgement, ID check, extension and answer letters, including what an access answer must contain. You can export the log as JSON or CSV. It does not search your systems, decide whether a request is excessive, or redact documents for you, and it is not legal advice.

Consultant, DPO service or law firm

An adviser brings judgement a template cannot. A consultant is the better choice when:

the request is part of a dispute, such as an employment conflict or a threatened claim;
you are considering refusing or charging a fee because the request may be manifestly unfounded or excessive, which you must be able to demonstrate [1];
the data includes special categories, such as health data, or a lot of information about other people;
you receive many requests or process data at a scale where a formal process with a DPO is warranted;
a supervisory authority is already involved.

The trade-offs are cost and the fact that request data goes to another party. Many organisations combine approaches: a simple log and letters for routine requests, and an adviser for the hard ones.

A quick way to decide

Is the request routine, from a known customer, with data in a few systems? A spreadsheet or DSAR Desk is enough.
Do you get more than a handful a year, or want letters and deadlines you do not have to rebuild? DSAR Desk.
Is there conflict, sensitive data, a possible refusal, or an authority involved? Call an adviser.

Whatever you choose, these guides cover the rules: the response letter template, the deadline and extension guide and the identity verification guide.

Related guides

Sources

This guide explains the rules in plain language. It is not legal advice. Check your own country's law and, when in doubt, ask a qualified adviser.