DSAR software can coordinate requests from intake to response, but it cannot decide by itself what the requester is entitled to receive. A GDPR access request may arrive by email, a support chat, a letter or a portal. The controller must identify the relevant personal data and Article 15 information, protect other people’s rights, and respond without undue delay and within one month of receipt under Article 12(3), subject to its qualified extension rule. The comparison that matters is therefore a demonstration of one real workflow against the same facts, rather than a vendor’s count of connectors or an unverified “cost per request.”
This article compares procurement approaches and five publicly documented products: OneTrust, TrustArc, DataGrail, Osano and Transcend. Their own sites are evidence of advertised capabilities, not independent proof of performance, package inclusion, price or GDPR compliance. The publisher also offers privacy software; apply the same written-evidence and live-demo standard to that offer. For the legal steps behind a request, use the data subject access request guide. This page focuses on choosing and testing the tool.
Define the request your software must handle
Start with a plausible request: a former customer asks for all personal data held about their account and support history. Some information sits in a CRM, some in a helpdesk, and an external provider holds ticket attachments. The request also mentions an email address the customer no longer controls. This scenario tests intake, identity, search, processor assistance, third-party review and secure delivery. Give every supplier the same synthetic records, including one support note that names another person and one derived fraud score. A polished preloaded demo with different facts does not answer your procurement question.
Set acceptance criteria before watching a product. Can the system capture a request received outside its portal? Does it preserve the original receipt date? Can a case owner see missing systems and assign work? Does it distinguish access from portability and erasure, which have different conditions? Can reviewers explain an exclusion or partial response, and export the final package and decision history? Record what the software actually did, what required manual work, and what the salesperson said would be available in a different tier.
The EDPB’s final Guidelines 01/2022 on access, adopted in 2023, stress that people need not use a particular form. A portal can improve a workflow, but it must not become a gate that silently discards requests submitted through another channel. Ask the supplier to show how support staff forward an email or letter into the case system without resetting the clock. A product that only times portal submissions can create a false sense of control.
Intake and proportionate identity checks
Article 12(6) allows the controller to ask for additional information necessary to confirm identity where it has reasonable doubts. It does not authorise a mandatory passport scan for everyone. For the test case, the old email address may justify more checking, whereas a current authenticated account may provide useful assurance. The method must fit the risk of releasing the requested data. An email challenge alone may be insufficient for particularly sensitive records if the mailbox may be compromised; an ID document is not automatically required whenever a request is large.
Ask the vendor to demonstrate conditional verification. Who chooses the level? Can the team record why it had doubts, what information it requested, and when it disposed of that extra information? Can the system avoid retaining an ID copy in a general support ticket? The Dutch supervisory authority’s current DPG Media case summary explains why routine ID copies were excessive. Its original January 2022 decision imposed EUR 525,000; the authority’s September 2025 update records a final amount of EUR 262,500 after judicial review. Distinguish the original decision from the later outcome. The case illustrates the risk of over-verification, not a universal ban on justified identity checks.
The interface should make the compliant route easy: ask for the least extra information that resolves a genuine doubt, then move to search and response. Check accessibility and language of the form, as well as staff ability to use the workflow without requiring a person to create a new account. A request on behalf of another person needs a separate authority check; do not let an “agent” checkbox replace evidence of representation.
Find data without confusing a connector list with coverage
Discovery is a matter of scope and data mapping. A product can have hundreds of advertised integrations and still miss the custom database where your organisation actually stores the requester’s information. In the demonstration, compare the set of systems searched against your own record of processing activities and system inventory. Ask which connections perform live retrieval, which merely create a task for a human, which data are indexed, and whether the licence includes those integrations. A task emailed to a system owner is useful, but it is not automatic discovery.
Backups, archives, logs and processor systems require a reasoned handling plan. They should not be promised as instantly searchable or universally excluded. The team must identify personal data within the scope of the right, applicable restrictions and technical realities, then document how it reached the response. When a processor holds relevant information, Article 28 requires assistance with the controller’s obligations in light of the nature of processing; test the escalation channel and service terms. Do not assume a vendor’s processor connection makes every legal judgment for you.
Use a small set of measurable outcomes. How many of the known synthetic records were located? How many required a manual task? Did the system duplicate the same item across exports? Could a reviewer identify the source and date? A product should help expose gaps rather than certify a search as “complete” merely because all configured connectors finished. The broader GDPR software comparison addresses platform choice; DSAR selection turns on this specific retrieval and review task.
Review, third-party rights and response package
Article 15 gives access to the requester’s personal data and contextual information. Article 15(4) says the right to obtain a copy must not adversely affect others’ rights and freedoms. It does not say every record naming a colleague or another customer must be removed in full. In the test ticket, try masking the other person’s contact details while retaining the requester’s own message and relevant context. Ask whether the product keeps the original protected, records the redaction decision, and generates a reviewable export. Automated suggestions are helpful only if a reviewer can check both over-disclosure and over-redaction.
A derived score may be the requester’s personal data even though it was created by the controller. Do not borrow the narrower “provided by the person” limit from Article 20 portability and apply it to Article 15 access. Likewise, a request covering several rights should not be forced into one legal template. The right-of-access guide helps the reviewer distinguish a copy of data, Article 15 information and any applicable restriction. Your acceptance test should include both a straightforward disclosure and an explained partial response.
The delivery channel matters. Check file size, encryption or authenticated retrieval, recipient verification, expiry of a download link and how the organisation proves what was supplied. Avoid putting an entire sensitive export in ordinary email simply because the workflow can send email notifications. Ask whether the software separates an acknowledgement, an extension notice, a final response and a notice of non-action. Each message serves a different purpose and may have different required content.
The deadline is a legal clock, not just a dashboard
Article 12(3) requires information on action taken without undue delay and within one month of receipt. Where necessary because of complexity and number of requests, that period may be extended by two further months, but the person must be informed of the extension and reasons within the initial month. The right-of-access guidelines explain practical handling of the clock. Test the product with a request received near month-end and one received on a weekend. Ask where the original receipt timestamp is stored, what timezone is used, how an extension is approved and whether an alert can be missed when the assigned employee is absent.
Article 12(4) is a separate gate: if the controller does not act on a request, it must inform the person of the reasons without delay and at the latest within one month of receipt, and explain the possibility of a supervisory complaint and judicial remedy. A tool that merely marks the ticket “closed – denied” has not produced the required communication. Test partial refusals, an inability to identify the requester and a restriction based on another person’s rights, keeping the legal reason specific. The Article 12 transparency guide can support the message design.
Software can calculate reminders, but the controller chooses whether an extension is justified and whether a response is complete. Ask to see the notification sent and its delivery evidence, not just a green status badge. If your organisation also handles requests under other laws, keep jurisdiction and legal basis visible so that a global workflow does not silently substitute a different deadline for a GDPR request.
Five candidates to invite into the same test
OneTrust advertises DSR automation covering intake, identity checks, discovery, review and response. Ask which functions are configured, which are licensed and which systems are actually connected in your environment. Its own page includes large efficiency claims; treat them as marketing assertions, not a measured saving for your team. Demand a demonstration of a non-portal request and third-party review.
TrustArc lists an Individual Rights Manager within its privacy offering. The public description supports considering it as a workflow candidate, but does not establish the quality of a particular integration, language configuration or price. Ask how identity rules, partial responses and regional policies are configured. Compare the answer against the same synthetic request rather than an unrelated consent-management demonstration.
DataGrail documents a Request Manager workflow and the connections needed for intake and data retrieval. Its documentation distinguishes API integrations from manual/direct-contact actions, a distinction worth testing in every product. Ask which of your systems have an operational connection, who maintains credentials and how the team discovers a newly adopted application. Do not infer that the existence of a connector means your entire data estate is searched.
Osano may be considered where a team wants privacy-request handling alongside other privacy work. Obtain its current product and package documentation directly before attributing any specific automation, hosted region or price to it. In the common demonstration, concentrate on the intake channel, conditional identity method, system-owner tasks and evidence export. If the seller cannot show a feature under your proposed contract, score it as unverified rather than absent or included.
Transcend provides documentation for request intake and an API. That makes it a candidate for a team prepared to connect internal systems, but the operational scope and engineering effort are facts to establish in the trial. Ask which steps an administrator configures, which require developer work and how a reviewer approves the response before delivery. There is no defensible winner without those local facts.
This is a comparison of testable procurement questions, not an independent feature parity laboratory or a league table. Do not assume one vendor is “EU-compliant” because of its headquarters, or that another is unsuitable because it is based elsewhere. Verify hosting, support access, subprocessors and any international transfers for your actual configuration. An Article 28 processor agreement or other binding Union/Member-State legal act must satisfy the applicable requirements; a generic vendor terms page alone may not answer those questions.
Calculate a real cost per completed request
Ignore unsourced market ranges. For your own baseline, record a representative month or quarter: requests received, staff hours spent searching and reviewing, external processor charges, escalation time and rework. Separate fixed cost from incremental cost. Then request a written three-year quote including licence, integration, verification provider, storage, additional legal entities, support, training and exit. Divide the total expected spend by the number of requests you actually expect to handle, while keeping fixed compliance value separate. At low volume, a well-managed manual process may be cheaper than any new platform; at high volume, automation can pay for itself if it really reduces repeated work.
Example: if a team handles 120 requests per year, spends six verified staff hours on each, and a trial reduces that to four while adding 80 hours of annual administration, the net annual saving is 160 staff hours before licence cost. That is arithmetic for a hypothetical team, not a vendor performance claim. Value the hours at your organisation’s fully loaded cost, include implementation and check whether the difficult requests still dominate. The GDPR software cost guide provides a broader budget framework; the DSAR purchase should be judged on this workflow’s own evidence.
Questions buyers should put to every supplier
Does a portal let us reject requests by email?
No. A portal can be convenient, but GDPR requests need no particular form. Your process must capture requests arriving through other channels and use their actual receipt date. Demonstrate email and support-ticket intake as well as the portal.
Can we require an ID document from every requester?
No. Article 12(6) permits necessary additional information where there are reasonable doubts about identity. Use a method proportionate to the data and the doubt, and protect any extra evidence collected. The DPG Media case illustrates the risk of routine excessive ID demands; it does not ban justified checks.
Will a connector find every copy automatically?
Only if the relevant systems are identified, connected, correctly configured and within the licensed scope. Manual tasks may still be needed for archives, processors or systems without a suitable API. The controller must review the search and answer, not accept an “all connectors complete” badge as a legal conclusion.
What happens if we cannot act on a request?
The case owner must send reasons without delay and at the latest within one month of receipt, together with information about a supervisory complaint and judicial remedy under Article 12(4). Ask the supplier to show the message and evidence of sending, including for a partial refusal.
The strongest choice is the tool that correctly handles your difficult test request at a cost you can substantiate. A secure intake form, a traceable search and a reviewer-controlled response matter more than an unsupported promise of effortless automation.