The AI Effect on DSAR Volume
Over the past 18 months, privacy teams across the UK have reported a noticeable uptick in Subject Access Request (DSAR) volume. While data breaches and regulatory enforcement continue to drive some requests, there's a newer force at play: individuals arming themselves with AI tools to draft complaints and discovery requests.
The Mechanism
The pattern is straightforward. An individual discovers that:
1. Their personal data has been processed by a company in a way they don't like 2. They want leverage to negotiate removal, correction, or compensation 3. They feed the facts into ChatGPT or Claude and ask: "Draft me a legal DSAR to this company"
The output is usually reasonable enough to send. It references GDPR articles, mentions timelines, sounds official. The recipient organization receives what looks like a well-informed request, even if it's technically from someone who's never studied data protection law.
For compliance teams, this means:
- Higher volume, shorter turnaround pressure. A DSAR drafted by an LLM still must be treated as a valid request. - Less predictability. AI-generated requests can be oddly specific or legally creative—not always in ways that map neatly to your data mapping. - Scope creep. LLMs tend to ask for everything under the sun. "All personal data" becomes a very broad interpretation.
Why This Matters
From a privacy professional's perspective, this isn't a regulatory problem—it's an operational one. Your DSAR process needs to handle volume, and your response needs to be thorough and defensible, regardless of who drafted the request.
The good news: a well-designed DSAR workflow and a clear data inventory make this manageable. The bad news: there's no "AI discount" on the 30-day clock.
What's Next?
I suspect we'll see:
1. Increased automation on the compliance side — more teams building intake and response workflows to handle scale. 2. Clearer guidance from the ICO on what constitutes a valid DSAR and common abuse patterns. 3. Longer response times for complex requests — organizations pushing the boundaries of the 30-day window as volume grows.
The DSAR Deadline Calculator on this site was actually built with exactly this in mind: helping teams stay on top of the administrative burden when volume spikes.