You may run into several issues with DSARs, including:
Difficulty locating all the personal information: If you haven’t audited your data collection and storage, you may not know where all the personal information that someone is requesting is located.
Verifying requestor identity: The first step in responding to a DSAR is verifying a requestor’s identity. The verification process should not involve collecting more personal information than you already have.
DSAR documentation: Simply responding to DSARs is not always sufficient. You should also keep an audit log in case of a complaint or external review.
Time to respond: You may find that completing DSARs takes longer than expected, especially if you receive a large number of requests. Creating a standardized DSAR process and a detailed list of your data collection and storage processes can help simplify the response process.