New research published today by Reveal, the provider of integrated AI-native platforms spanning the dispute resolution lifecycle, found that large European organisations complete fewer than half of data subject access requests (DSARs) within the one-month deadline required under the General Data Protection Regulation (GDPR), a shortfall the study ties directly to a near-universal absence of purpose-built technology. Nearly nine in 10 organisations still run DSARs on manual or general-purpose workflows, with no dedicated tooling in place.
The report, based on a survey of 213 legal and privacy professionals at large European enterprises, is the first of its kind to benchmark how organisations across the region are managing DSAR compliance at scale.
The findings expose structural inconsistencies between how organisations perceive their DSAR processes and how those processes perform. Ninety percent of respondents said they are confident their process would withstand scrutiny from an Information Commissioner's Office (ICO) or data protection authority (DPA). Yet only 47% of DSARs are completed within the standard one-month deadline, 53% require an extension, and fewer than a quarter (24%) describe their process as fully standardised and repeatable.
Notably, the delay isn't a matter of effort. The average full response takes under seven days once work begins, pointing to coordination and workflow bottlenecks as the primary source of missed deadlines. Without dedicated tooling to locate and pull relevant data across systems, organisations lose the statutory clock to the manual work of finding, reviewing, and coordinating the data itself.
“Organisations are working hard and spending heavily on DSAR compliance but, in many cases, still aren’t getting the outcomes GDPR requires,” said Eric Harmon, CEO of Reveal. "Most DSAR programs were never built for today's data environment, and it shows in the deadline numbers. AI is only raising the stakes."
Generative AI tools have complicated the picture further. Applications such as ChatGPT, Claude and Gemini now near email as the most common systems organisations must search when responding to a DSAR. Nearly nine in 10 organisations (86%) have already received a DSAR that required them to search data held in a generative AI tool, a development most DSAR workflows were never designed to handle.
Spending underscores this point. Organisations pay an average of €680,000 a year on DSAR responses, with more than half (53%) spending over €500,000 and nearly a quarter (23%) exceeding €1 million, and still miss the deadline more often than they meet it.
"Across EMEA, DSAR demands are outpacing the processes many organisations have in place," said Eugene O'Neill, Executive Vice President, EMEA at Reveal. "This research makes clear that modernising those processes can't wait."
The report is part of Reveal's broader effort to support legal and privacy teams navigating GDPR compliance across EMEA. Reveal's platforms include Logikcull, which is purpose-built for DSAR fulfilment, connecting directly to systems like Microsoft 365, Google Workspace, and Slack, automatically surfacing personally identifiable information, and giving legal, privacy, IT, and HR teams one defensible workflow to collect, review, and redact in bulk. More than 600 legal, IT, HR, and infosec teams already use it to respond to DSARs faster and more consistently.
To learn more about Reveal or read the full report, visit www.logikcull.com/industry-reports/dsars.
About Reveal
Reveal is a leading AI-powered platform for eDiscovery, document review, legal hold, and investigations. Its best-in-class suite of products includes Logikcull, Onna, Reveal Hold, Reveal Enterprise, and Brainspace. Reveal's software combines technology and human guidance to transform structured and unstructured data into actionable insight, helping law firms, corporations, government agencies, and service providers uncover useful information faster. For more, visit revealdata.com.
View source version on businesswire.com: https://www.businesswire.com/news/home/20261006140505/en/
© Business Wire, Inc.
Haftungsausschluss :
Diese Pressemitteilung ist kein von AFP erstelltes Dokument. AFP übernimmt keine Verantwortung für ihren Inhalt. Bei Fragen wenden Sie sich bitte an die im Text der Pressemitteilung genannten Kontaktpersonen/Stellen.