Over Half of DSARs Need Extensions, Reveal Study Finds
With 86 per cent of organisations still lacking dedicated DSAR technology, fewer than half of requests are completed within GDPR’s standard one-month window, even as spending climbs
New research published by Reveal, a provider of integrated AI-native platforms spanning the dispute resolution lifecycle, found that large European organisations complete fewer than half of data subject access requests (DSARs) within the one-month deadline required under the General Data Protection Regulation (GDPR). The study ties this shortfall directly to a near-universal absence of purpose-built technology. Nearly nine in 10 organisations still run DSARs on manual or general-purpose workflows, with no dedicated tooling in place.
The report is based on a survey of 213 legal and privacy professionals at large European enterprises. According to Reveal, it is the first of its kind to benchmark how organisations across the region manage DSAR compliance at scale.
The findings expose structural gaps between how organisations perceive their DSAR processes and how those processes perform. Ninety per cent of respondents said they were confident their process would withstand scrutiny from the Information Commissioner’s Office (ICO) or data protection authority (DPA). Yet only 47 per cent of DSARs are completed within the standard one-month deadline, 53 per cent require an extension and fewer than a quarter (24 per cent) describe their process as fully standardised and repeatable.
Notably, the delay isn’t a matter of effort. The average full response takes under seven days once work begins, pointing to coordination and workflow bottlenecks as the primary source of missed deadlines. Without dedicated tooling to locate and pull relevant data across systems, organisations lose time against the statutory clock to the manual work of finding, reviewing and coordinating the data itself.
‘Organisations are working hard and spending heavily on DSAR compliance but, in many cases, still aren’t getting the outcomes GDPR requires’, said Eric Harmon, CEO of Reveal. ‘Most DSAR programs were never built for today’s data environment, and it shows in the deadline numbers. AI is only raising the stakes.’
Generative AI tools have further complicated the picture. Applications such as ChatGPT, Claude and Gemini are now near email as the most common systems organisations must search when responding to a DSAR. Nearly nine in 10 organisations (86 per cent) have already received a DSAR that required them to search data held in a generative AI tool, a development most DSAR workflows were never designed to handle.
Spending underscores this point. Organisations spend an average of €680,000 a year on DSAR responses, with more than half (53 per cent) spending over €500,000 and nearly a quarter (23 per cent) exceeding €1 million. Yet they still miss the deadline more often than they meet it.
‘Across EMEA, DSAR demands are outpacing the processes many organisations have in place’, said Eugene O’Neill, Executive Vice President, EMEA at Reveal. ‘This research makes clear that modernising those processes can’t wait.’
About Reveal
Reveal is a leading AI-powered platform for eDiscovery, document review, legal hold and investigations. Its best-in-class product suite includes Logikcull, Onna, Reveal Hold, Reveal Enterprise, and Brainspace.
