Introduction

As awareness of privacy rights continues to grow, organisations are seeing a steady increase in Data Subject Requests (DSRs). Individuals are becoming more informed about their rights, while AI-powered tools and readily available templates have made it easier than ever to submit requests at scale.

For many organisations, managing DSRs efficiently remains a challenge. While all rights require a response, Data Subject Access Requests (DSARs) often create the greatest operational burden due to the volume of data that may need to be searched, reviewed and disclosed.

With the introduction of the concept of a reasonable and proportionate search under the Data (Use and Access) Act, organisations have a greater opportunity to manage requests effectively while continuing to uphold individuals’ rights. One of the most valuable tools in achieving this is a well-designed DSR intake form.

Unfortunately, many organisations still either fail to use intake forms effectively or design them in a way that creates unnecessary friction for the requester.

What Are Data Subject Rights (DSRs)?

Data protection legislation provides individuals with a range of rights over their personal data. These rights are commonly referred to as Data Subject Rights (DSRs).

Some of the most frequently exercised rights include:

Right of Access

The right of access allows individuals to request a copy of the personal data an organisation holds about them, along with information about how that data is being processed.

Right to Rectification

Individuals can request that inaccurate personal data is corrected or completed if it is incomplete.

Right to Erasure

In certain circumstances, individuals may ask for their personal data to be deleted.

Right to Restriction of Processing

This allows individuals to request that an organisation temporarily limits the use of their personal data.

Right to Object

Individuals may object to specific processing activities, particularly where personal data is processed based on legitimate interests.

Right to Data Portability

Where applicable, individuals can request their personal data in a structured, commonly used and machine-readable format.

While each right has its own challenges, the right of access is often the most resource-intensive due to the volume of information that may need to be located and reviewed.

Why DSARs Create the Greatest Operational Burden

Modern organisations store personal data across a wide range of systems. Information may exist within:

• Email archives
• Microsoft Teams chats
• SharePoint sites
• HR systems
• CRM platforms
• Ticketing systems
• Cloud storage environments
• Collaboration tools

When a DSAR is submitted without sufficient context or scope, organisations can find themselves searching large volumes of potentially relevant information across multiple systems.

This is particularly true in organisations that utilise tools such as Microsoft Purview or Google Vault, where broad search terms can generate thousands of results requiring review.

The result is often significant time spent processing information that may not ultimately be relevant or useful to the requester.

The Impact of Reasonable and Proportionate Searches

The concept of conducting a reasonable and proportionate search is becoming increasingly important within DSAR management.

While organisations must continue to take access requests seriously, there is growing recognition that responding to a request should involve a balanced and sensible approach. Organisations should be able to demonstrate that they have taken appropriate steps to locate relevant information without undertaking disproportionate searches that provide little additional value.

This is where effective engagement with the requester becomes critical.

By understanding what information the individual is actually seeking, organisations can focus their searches on the areas most likely to contain relevant data, improving efficiency while still meeting their obligations.

An intake form can play a key role in achieving this balance.

How Intake Forms Improve DSR Management

A DSR intake form should not be viewed as a barrier to exercising privacy rights. Instead, it should be seen as a mechanism for facilitating a more effective response.

When designed correctly, an intake form benefits both the organisation and the individual making the request.

Clarifying the Nature of the Request

One of the most common issues organisations face is receiving vague requests.

For example, an individual may simply write:

“I would like all the information you hold about me.”

An intake form can help clarify:

• Which right is being exercised
• The reason for the request, where voluntarily provided
• Whether the individual is seeking specific information
• Whether the request relates to a particular incident or interaction

This clarity can significantly improve the efficiency of the response process.

Helping to Define Scope

A well-designed form can encourage the requester to provide information that narrows the scope of the search.

For example:

• Relevant date ranges
• Specific departments
• Particular projects
• Named individuals
• Key communications or interactions

In many cases, data subjects are not interested in every piece of personal data held by an organisation. They are often searching for information relating to a specific issue, event or decision.

Understanding this at an early stage allows organisations to conduct more targeted searches.

Reducing Delays

Poorly scoped requests often lead to lengthy correspondence seeking clarification after the request has been submitted.

An intake form captures this information upfront, reducing delays and enabling investigations and searches to begin sooner.

This not only supports compliance but also improves the overall experience for the data subject.

Improving Search Effectiveness

Searches conducted within platforms such as Microsoft Purview or Google Vault are only as effective as the information available to the team carrying them out.

Additional details provided through an intake form help privacy teams develop more focused search strategies, reducing unnecessary review effort and improving the quality of the information returned.

Common Mistakes We See with DSR Intake Forms

At GRC Hub, we regularly encounter organisations that have implemented intake forms but are not getting the full value from them.

Treating the Form as Mandatory

Individuals should be able to exercise their rights through a variety of channels.

An intake form should support and streamline the process, not act as a prerequisite that prevents a request from being recognised.

Requesting Excessive Information

Some forms ask for more information than is necessary.

This can discourage engagement and create an impression that the organisation is intentionally making the process difficult.

Only information genuinely required to identify the requester or understand the request should be collected.

Missing Opportunities to Narrow Scope

Many forms focus heavily on administrative details while failing to ask questions that support a reasonable and proportionate search.

Questions relating to dates, locations, systems, interactions and areas of concern often provide far greater value.

Failing to Explain the Benefits

Individuals are much more likely to provide helpful information when they understand why it is being requested.

A simple explanation that additional details may help locate relevant information more quickly can significantly improve engagement.

What Makes an Effective DSAR Intake Form?

An effective intake form should be:

• Simple and easy to complete
• Accessible across devices
• Written in clear, plain language
• Focused on understanding the request
• Designed to support proportionate searches
• Flexible enough to accommodate different rights
• Supported by appropriate identity verification processes

Most importantly, it should help both parties achieve the same objective: ensuring the individual receives the information they need while enabling the organisation to manage the request efficiently.

Final Thoughts

As DSR volumes continue to increase throughout 2026, organisations need practical ways to balance compliance obligations with operational realities.

A well-designed intake form is one of the simplest and most effective tools available. Far from creating barriers, it can help data subjects obtain the information they genuinely want while enabling organisations to conduct more focused, reasonable and proportionate searches.

For organisations looking to improve their DSR processes, reviewing and refining the intake form is often an excellent place to start. Done correctly, it can reduce administrative burden, improve response quality and create a better outcome for everyone involved.