The Holders' Request Management (DSAR) module is the Privacy Tools that receives, authenticates, processes, and verifies requests from data subjects within the legal timeframe.
Automate, control, and verify compliance with data subject needs using security, traceability, and intelligence.
DSAR transforms policyholder service into a structured, secure, and scalable process, providing a positive experience for the policyholder and complete traceability for the organization.
Explore the features that make this solution complete, practical, and efficient.
Create and publish forms with adaptable fields, custom HTML, and company visual identity.
Confirmation via email and control over who can access the requested data.
Distribute tasks, assign responsibilities, control deadlines, and organize the process in a scalable way.
Manual, assisted (with templates), semi-automatic, or automatic — you choose the one that best suits each type of request.
Configure confirmation, reply, pending, and revocation emails with institutional standards.
Track average response time, number of requests by type, estimated cost per request, and other insights.
The DSAR module integrates with the Privacy Portal of Privacy Tools, allowing the holders to:
The Portal is 100% customizable and can be published on your website, app, or intranet.
PrIA, artificial intelligence from Privacy ToolsThis can assist the privacy team in analyzing, suggesting, and even drafting responses to requests, based on best practices and legal context.
PrIA transforms regulatory knowledge into practical solutions.
By integrating the DSAR module with Data Discovery, your company can automatically locate and delete personal data while fulfilling requests from data subjects.
Connect the DSAR module to the Business Intelligence resource and monitor the situation:
The DSAR module is suitable for organizations that receive a high volume of requests from policyholders or through multiple channels: hospitals and laboratories (patients requesting tests and medical records), banks and cooperatives, retailers and e-commerce businesses, universities, public service providers, software companies acting as operators, and government agencies. It also serves those who receive few requests but need to prove that each one was authenticated, fulfilled on time, and recorded.
Article 18 of LGPD The text lists the rights of the data subject: confirmation of the existence of processing, access, correction, anonymization, blocking, deletion, portability, information about sharing, and revocation of consent. Article 19 establishes immediate compliance in a simplified format or within 15 days for the complete declaration, and the... ANPD regulation on data subject rights It details deadlines, channels, and the duty to facilitate the process. In GDPRArticles 12 to 22 deal with the same matter, with a deadline of one month.
The module integrates with the Privacy Portal (request entry), to Consent Management (revocations), to Data Discovery (location and deletion of data), to PrIA (suggested responses) and to Business Intelligence (indicators). The logs of each request, with protocol, authentication, responsible parties, deadlines and response sent, are the evidence required in audits and inspections by the ANPD.
Na AFIPRequests for test results, which reached 200 per day and were handled by email, dropped to about 20 per month after the service gained visibility and structure. Copel The company has made the Privacy Portal available on its website, with a form integrated into the tool for data subjects to exercise their rights. Eletrobras reports improved responsiveness to requests from data subjects, and FIEMG, eSales and Unicap They also use the module. See also What is DSAR? in the glossary.
Through customized forms published on channels of your choice. The link can be in the footer of the website, app, or Privacy Portal.
No. You can configure the module to work manually, with assistance (using templates), semi-automatically, or automatically (if you have the Data Discovery module contracted), depending on the type of entitlement.
Yes. The system sends confirmation via email and requires validation before releasing any information.
Yes. Integration with Data Discovery allows you to locate the requested data and respond more securely and quickly.
Yes. The DSAR module offers comprehensive dashboards, with filters for entitlement type, response time, unit, and other important metrics.
To compare the types of tools on the market, see the guide to... best tools for LGPD.
Under the LGPD (article 19), confirmation and access are granted immediately in a simplified format or within 15 days via a complete declaration; the ANPD regulation details the other rights. Under the GDPR, the general deadline is one month. The module manages these deadlines by type of right in each workflow.
With applicant authentication: the system sends confirmation via email and requires validation before releasing any information. Access to order data is also restricted to the authorized personnel defined in the workflow.
Yes. The request enters the deletion workflow, and the integration with Data Discovery allows you to locate and delete the data subject's data from connected sources, recording the action in the logs.
Yes. The form can be published directly on the website or in the app. The Portal provides the data subject with a view of their consents and policies in one place.
Volume of requests by type of entitlement and by channel, average response time, requests within and outside the deadline, and bottlenecks by area, in module dashboards and in Business Intelligence.
Request a demo and see how the DSAR module can strengthen your privacy program.
