DSAR Case Study: Three Weeks to Five Days

A sports governing body was handling data subject access requests (DSARs) by hand, across several systems, with each one taking around three weeks. After connecting its systems to DSAR.ai’s AI-powered platform, its average processing time fell to five days, and it handled a 200% increase in requests during peak sports seasons without additional staffing. 

The organisation 

The Sports Games Official Board (SGOB) is a governing body responsible for organising and managing official sports events across multiple disciplines. It oversees thousands of athletes, officials and support staff, which means it holds personal information about a large and active community. 

The challenge 

Athletes, officials and other stakeholders regularly submitted DSARs to see the information the board held about them. Handling them was slow, for three reasons. 

Information was spread out. Personal data sat across several systems, including databases for event management, HR and disciplinary records. Every request meant searching each one. 

The process was manual. Handling requests by hand was time-consuming and made regulatory deadlines harder to meet. 

Some records were sensitive. Disciplinary and other records needed careful redaction before anything could be shared. 

The result was an average of three weeks to process a single request. 

The approach 

The board adopted DSAR.ai’s AI-powered platform. 

Connected systems. DSAR.ai was integrated with the board’s key data sources, including its athlete management system, HR database and cloud storage. That let searches run across all of them from one place. 

A single front door. A secure portal gave people one place to submit requests, with built-in identity verification so only authorised individuals could access their data. 

AI-assisted search and redaction. The platform scanned the connected systems to locate the requester’s personal data, then identified and redacted sensitive information, such as third-party data and confidential records. 

Workflows that fit the rules. The board’s legal and compliance teams configured the workflows to match their regulatory requirements. 

A clear response and a full record. Each request produced a report that was shared securely with the requester, and the platform kept an audit trail for compliance purposes. 

The outcome 

Faster responses. The average time to process a DSAR fell from three weeks to five days. 

Fewer errors. AI-powered redaction reduced the errors that come with manual review. 

Capacity for peak seasons. The board handled a 200% increase in DSARs during peak sports seasons without additional staffing. 

Stronger trust. Faster, more accurate responses strengthened trust with athletes, officials and other stakeholders. 

What other teams can infer from it 

The board’s situation is common well beyond sport. Any organisation with a large community, information in several systems and busy seasons will recognise it. A few lessons travel well. 

Know where the data lives. Finding information is often the slowest part of a DSAR. Mapping the systems that hold personal data, and connecting them where possible, makes every request quicker. Under UK GDPR, the search must be reasonable and proportionate, and a clear map makes that easier to show. 

Plan for the busy months. As this board found, requests don’t always arrive evenly. The one-month time limit stays the same in peak season, so the process has to cope when demand rises.

Keep people in the loop on redaction. Automated redaction speeds up review, but decisions about other people’s information and exemptions still need a reasoned, recorded judgement. 

Keep the record. An audit trail shows what was searched, what was withheld and why. Since 19 June 2026, organisations must also have a process for data protection complaints, and a clear record makes those far easier to answer. 

New to the process?  

Start with our step-by-step guide to handling a subject access request. For short, insightful updates each week, follow DSAR.ai on LinkedIn. And if there’s a tricky request on your desk, talk to our team.