In most organisations, the person responsible for receiving, logging and processing DSARs will be the Data Protection Officer, or DPO. The UK GDPR requires organisations to appoint a DPO if they are a public authority or body, or if they carry out certain types of processing activities. DPOs have overall responsibility for data protection in their organisation. For organisations for whom it isn’t mandatory to appoint a DPO, it’s still a good idea to have someone identified in the business whose responsibility it is to deal with data protection issues, including Data Subject Access Requests. Whilst whoever is in charge of handling a DSAR might not be the one physically searching through the data to find the desired information, they will be overseeing the process to ensure that it is being completed in line with the GDPR’s requirements. It is important for DPOs and those who deal with DSARs to be well trained in all aspects of data protection, as falling foul of the GDPR can have negative consequences for organisations.