DSAR systems

DSAR systems represent the services and platforms where your organization stores personal data — for example, Shopify, Stripe, your CRM, email marketing tools, or internal databases. When a new DSAR request comes in, all active systems are automatically attached to it as a checklist, so you know exactly which systems need to be reviewed for each request.

You can manage your DSAR systems by navigating to the DSAR section in your dashboard and clicking Systems.

Adding a system

To add a new system:

1. Click the Add System button on the Systems page.
2. Enter the system name (e.g., “Shopify”, “Mailchimp”, “Internal CRM”).
3. Enter the instructions for how to process a request in this system. Instructions support Markdown formatting (headings, lists, links, code blocks), so you can structure them clearly for the people handling requests.
4. Save the system.

The system will be marked as active by default and will be automatically attached to all new DSAR requests going forward.

Editing a system

To edit an existing system, click on the system name in the list. You can update the name and instructions. Changes to a system’s instructions only affect new requests — existing requests retain the instructions that were in place at the time the request was created (a snapshot is taken when the request is submitted), so historical records of what instructions applied to a given request are never altered.

Deleting a system

To delete a system, click the delete option next to the system in the list. Deleting a system does not remove it from existing requests that already have it attached. It only prevents the system from being included in future requests.

Writing good instructions

Clear, detailed instructions help ensure that requests are processed consistently and completely. Good instructions should tell the person handling the request exactly what to do in each system.

Example instructions:

• Shopify — “Log in to Shopify admin. Go to Customers and search for the data subject’s email address. For access requests, export their customer profile and order history. For erasure requests, use the customer data erasure tool under Settings > Privacy.”
• Mailchimp — “Log in to Mailchimp. Search for the subscriber by email. For access requests, export their profile and activity data. For erasure requests, permanently delete the subscriber from all audiences.”
• Internal database — “Connect to the production database. Query the users table by email address. For access requests, export all rows from users, orders, and support_tickets tables. For erasure requests, run the data anonymization script.”

Syncing systems to existing requests

When you add a new system, it is only automatically attached to requests created after the system was added. If you want to add the new system to existing open requests, click the Sync Services button on the Systems page. This will attach all active systems to any pending requests that do not already have them.