How to handle a data subject access request (dsar) on Starch

A Data Subject Access Request is a formal ask from an individual — a customer, a former employee, a prospect — for a copy of every piece of personal data your business holds on them. Under GDPR you have 30 days to respond. Under CCPA it's 45. Miss the window, respond incompletely, or lose track of the request entirely, and you're looking at regulatory complaints, fines, and the kind of reputational friction that's hard to undo for a small team.

What this looks like in practice varies considerably. A B2C brand fielding hundreds of these a month has a different problem than a professional services firm that gets one every few quarters but needs an airtight audit trail for each. The intake step — catching the request, confirming identity, logging it, and routing it to the right person — is where most operators drop the ball.

On Starch, you end up with a tracked, time-stamped intake log that lives in one place: every request captured from your inbox, every identity confirmation noted, every deadline visible, and the right person automatically notified when action is due. No request sits unanswered in an email thread you forgot to flag. No deadline creeps up without a reminder. You describe the workflow you need — which channels to watch, how to route by request type, what your response SLA is — and Starch builds the intake surface and keeps it running.