Manually processing a single data subject access request costs $1,524 on average, according to Gartner's 2021 Market Guide for Subject Rights Request Automation, still the figure privacy vendors and DPOs cite as the industry benchmark in 2026. That per-request cost climbs sharply once a request turns complex, cross-border, or litigation-adjacent, and the total bill compounds fast: total DSAR volume itself rose 43% year over year between 2023 and 2024.
How much does a DSAR actually cost to process?
Gartner's benchmark of $1,524 per manually processed subject access request applies to organizations with at least 100 employees and $50 million or more in annual revenue, and it has held as the reference figure since Gartner's 2021 Market Guide for Subject Rights Request Automation, up from $1,406 in the firm's 2020 estimate. UK-specific research tells a different story once local labor costs are fully accounted for.
Figure 1: Cost per DSAR climbs sharply with complexity and jurisdiction. UK figures converted from GBP at approximately 1.27 USD per GBP for comparison. Sources: Gartner, Market Guide for Subject Rights Request Automation (2021); Sapio Research for Guardum (2020); industry cost reporting on complex UK cases.
No public research organization has published an updated per-request cost estimate since Gartner's 2021 figure, yet it remains the number cited across the privacy operations industry in 2026, including in DataGrail's own 2026 Guide to DSAR Automation. Businesses relying on a five-year-old benchmark while their own request volume climbs are likely underestimating their real annual spend, since a static per-request figure does not capture the added review time that comes with larger, messier datasets. Sites that keep their privacy policy generated and current at least reduce one variable in that equation: fewer disputes over what was disclosed at collection time means fewer DSARs that escalate into a manual legal review.
Why is the UK figure so much higher than the US benchmark?
A 2020 survey of 100 UK data protection officers at companies with 250 or more employees, conducted by Sapio Research and commissioned by Guardum between 29 April and 5 May 2020, found that the average DSAR consumed 66 working hours and cost GBP 4,884.53 to complete, more than four times Gartner's contemporaneous US figure. The gap comes from what each estimate counts: Gartner's number is a per-request cost estimate for a defined organization segment, while the Sapio Research survey asked DPOs to report their fully loaded time and cost, including search, review, redaction, and sign-off across every system a request touched.
Figure 2: The benchmark rose from Gartner's 2020 to 2021 report, then has not been publicly re-estimated since. Source: Gartner, Market Guide for Subject Rights Request Automation, 2020 and 2021 editions, as cited in industry reporting through 2026.
The same 2020 survey found that DPOs at these UK firms received an average of 27 DSARs per month and that, across the business, DSAR handling consumed roughly GBP 1.59 million and 14 person-years annually. That scale of spend on a single compliance obligation is why so many privacy teams have since moved toward request automation rather than treating each DSAR as a one-off legal task.
| Scenario | Avg. cost per DSAR | Avg. hours | Primary source |
|---|---|---|---|
| US benchmark (100+ employees, $50M+ revenue) | $1,524 | Not disclosed | Gartner, 2021 Market Guide for Subject Rights Request Automation |
| UK average (250+ employee companies) | GBP 4,884.53 (approx. $6,200) | 66 hours | Sapio Research for Guardum, 2020 (n=100 DPOs) |
| UK complex case, outside counsel | Up to GBP 23,000 (approx. $28,700 to $29,200) | Not disclosed | Industry cost reporting on complex UK cases |
How many hours does a DSAR actually take to process?
At 66 working hours per request, the average UK DSAR consumes close to 30% of one employee's full working week, according to the 2020 Sapio Research survey. That time is spent locating personal data across every system that might hold it, reviewing each record for third-party information that must be redacted, and getting legal sign-off before the response goes out. Companies fielding 27 requests a month, the same survey's reported average, are effectively running a dedicated part-time role just to keep up with subject access requests alone.
The hours problem gets worse before it gets better. A request that touches email archives, CRM records, support tickets, and backup systems takes meaningfully longer to search than one confined to a single database, and most organizations now hold personal data across more systems than they did when the 2020 survey was fielded, not fewer.
What are the statutory deadlines for a DSAR response?
GDPR and UK GDPR give organizations one calendar month from receipt to respond, extendable by up to two further months for complex or numerous requests, provided the requester is notified of the extension within the first month, per GDPR Article 12(3). CCPA and CPRA give California businesses 45 calendar days, extendable by another 45 days when reasonably necessary, provided the consumer is informed of the extension and the reason for it.
Figure 3: The extension test differs by law, but both require notifying the requester before the clock runs out. Source: GDPR Article 12(3); California Civil Code Section 1798.130 (CCPA/CPRA).
Missing either deadline, even without an underlying data breach, is itself a compliance violation that a regulator or the requester can escalate. The 66-hour average processing time from the UK survey leaves little slack against a 30-day GDPR clock once a request needs escalation, legal review, or a records search across more than one system.
Why is DSAR volume rising so fast?
Total DSAR volume rose 43% year over year between 2023 and 2024, according to DataGrail's operational data drawn from its own customer base. The growth is not evenly spread across request types: deletion requests specifically have surged 567% since 2021, and data broker deletion requests alone jumped 398% in 2025, per DataGrail's 2026 Privacy and AI Trends Report. Consumer awareness is rising alongside the volume: 36% of internet users exercised a data access right in 2024, up from 24% in 2022, according to Cisco's 2024 Consumer Privacy Survey.
Figure 4: Cost benchmarks stayed flat while request volume kept climbing. Sources: Gartner (2020, 2021); Sapio Research for Guardum (2020); DataGrail, 2026 Privacy and AI Trends Report; Cisco 2024 Consumer Privacy Survey.
Rising volume without a rising per-request cost estimate is a warning sign, not good news: it means the true cost of DSAR compliance is being underestimated in most budget planning right now.
What share of requests are deletions versus access requests?
Deletion requests, not access requests, now make up the overwhelming majority of what privacy teams handle. Per DataGrail's 2026 Privacy and AI Trends Report, deletion requests account for 87% of total DSR volume, with access, correction, and other request types making up the remaining 13%.
Figure 5: Deletion has become the dominant request type by a wide margin. Source: DataGrail, 2026 Privacy and AI Trends Report.
That shift matters for cost modeling: a deletion request that must be propagated across every downstream vendor and backup system can take longer to fully execute and verify than a straightforward access request, even though most cost benchmarks were built around access requests as the default case.
How does complexity change the cost of a DSAR?
Cost does not rise in a straight line with complexity. A routine, single-system access request stays close to Gartner's $1,524 benchmark, while a cross-border request touching multiple vendors, or one connected to a workplace dispute or pending litigation, moves into a different cost tier entirely, sometimes by a factor of ten or more.
Figure 6: Illustrative positioning based on the cost tiers documented above; exact placement will vary by organization. Sources: Gartner (2021); Sapio Research for Guardum (2020); industry cost reporting on complex UK cases.
The requests that land in the top-right quadrant, litigation-adjacent and cross-border, are also the ones most likely to get outsourced to law firms at the GBP 23,000 figure cited earlier, since the legal and redaction review those cases require goes beyond what an in-house privacy team can safely handle alone. See our cost of privacy compliance benchmarks for how DSAR spend fits into a company's broader privacy budget.
The Bottom Line
Whether the right number for your organization is closer to Gartner's $1,524 US benchmark or the UK survey's GBP 4,884.53 fully loaded figure, the direction is the same: DSAR volume is climbing 43% a year, deletion requests now dominate at 87% of total volume, and the per-request cost benchmark most teams still budget against has not been publicly re-estimated since 2021. A business that is still pricing DSAR compliance off a five-year-old number, while its own request volume and system sprawl keep growing, is very likely underbudgeting. The practical fix starts upstream of the request itself: a current, accurate privacy policy and a documented data inventory shrink the search-and-review time that drives most of the 66-hour average, and a privacy policy generator built to stay current is one of the cheapest ways to keep that upstream discipline in place.
Frequently Asked Questions
How much does it cost to respond to a DSAR? About $1,524 per request on average when handled manually, according to Gartner's 2021 Market Guide for Subject Rights Request Automation, a figure still cited as the industry benchmark in 2026. UK-specific research puts the average closer to GBP 4,884.53, or roughly $6,200, once staff time is fully costed.
How many hours does a typical DSAR take to process? About 66 working hours per request, according to a 2020 Sapio Research survey of 100 UK data protection officers commissioned by Guardum, equal to roughly 30% of a full working week for one person.
What is the legal deadline to respond to a DSAR? Under GDPR and UK GDPR, one calendar month from receipt, extendable by up to two further months for complex or numerous requests. Under CCPA and CPRA, 45 calendar days, extendable by another 45 days when reasonably necessary.
How much more does a complex or outsourced DSAR cost? Complex, litigation-adjacent DSARs sent to outside counsel can run as high as GBP 23,000, roughly $28,700 to $29,200 depending on the exchange rate, according to industry cost reporting on UK subject access request cases.
Where the Numbers Come From
- Gartner. (2021). "Market Guide for Subject Rights Request Automation." Average manual processing cost of $1,524 per subject access request, for organizations with 100+ employees and $50M+ annual revenue, up from $1,406 in Gartner's 2020 estimate.
- Global Security Mag, citing Sapio Research for Guardum. (2020). Independent survey of 100 UK data protection officers at companies with 250+ employees, fielded 29 April to 5 May 2020. Average GBP 4,884.53 and 66 working hours per DSAR; GBP 1.59 million and 14 person-years spent annually; 27 DSARs received per month on average.
- GRC World Forums. "What is the true cost of handling DSARs?" Industry cost reporting citing complex UK DSAR cases outsourced to law firms at up to GBP 23,000 per request.
- DataGrail. (2026). "The 2026 Guide to DSAR Automation." 43% year-over-year increase in total DSAR volume, 2023 to 2024; Cisco 2024 Consumer Privacy Survey figures on data access right usage cited via Statista.
- DataGrail. (2026). "2026 Privacy and AI Trends Report." Deletion requests up 567% since 2021; data broker deletion requests up 398% in 2025; deletion requests account for 87% of total DSR volume.
- EUR-Lex, GDPR Article 12(3), and California Civil Code Section 1798.130 (CCPA/CPRA). Current statutory text on subject access request response deadlines and permitted extensions.
Note: All figures verified as of July 2026. The GBP 4,884.53 and GBP 23,000 figures are converted to approximate USD using a rate near 1.27 USD per GBP for comparison only; consult the original sources for exact local-currency figures. The Gartner per-request benchmark has not been publicly re-estimated since 2021 and will be updated in this post if a newer figure is published. Refreshed at least twice a year to track new DataGrail, Gartner, and DPO survey data.
