Companies with about 5 million monthly website visitors receive roughly 984 data subject access and deletion requests a year, according to DataGrail's 2026 Privacy and AI Trends Report. Request volume scales with a company's audience size rather than its headcount, and it has now set a new all-time high for five straight years running. Smaller sites and larger enterprises see very different absolute counts, which is why trackers increasingly report the figure per million tracked identities instead of a flat number: that normalized rate climbed from 248 to 859 between 2021 and 2023, a 246% jump in three years, per DataGrail's 2024 report.
How many DSARs does the average company receive per year?
984 access and deletion requests a year is DataGrail's benchmark for a company with about 5 million monthly website visitors, based on anonymized privacy operations data spanning hundreds of enterprise customers and more than 2,400 business systems. That figure is not a fixed number for every business; it is a traffic-scaled estimate, and DataGrail's own reporting shows the count rising and falling with audience size and industry rather than with employee count.
| Company profile | Estimated DSARs per year | Source |
|---|---|---|
| Average company (about 5M monthly site visitors) | 984 | DataGrail, 2026 Privacy and AI Trends Report |
| Professional services firm (4.6x the average) | roughly 4,526 (estimated) | Derived from DataGrail's reported 4.6x industry multiplier |
| Registered California data broker | 2,000+ deletion and 900+ opt-out requests per month | DataGrail, 2026 report |
Warning
The 4,526-request professional-services estimate above is our own multiplication of DataGrail's reported 4.6x multiplier against its 984-request baseline. DataGrail states the multiplier and the baseline separately; it does not publish a combined professional-services headline number itself.
Every one of those requests starts the same compliance clock. Before a team can answer an access request or fulfill a deletion, it has to confirm the requester is actually the data subject and route the request to the right process.
Figure 1: The compliance path a DSAR follows once it reaches a privacy team. Source: GDPR Articles 12 and 15; California Civil Code Section 1798.130.
A privacy policy that plainly documents this process, including who to contact and what to expect, cuts down on the duplicate and malformed requests that eat up a team's time before verification even starts. Businesses that have not reviewed how their policy describes this process can generate a privacy policy that spells out DSAR handling and deadlines rather than drafting the disclosure from scratch.
The takeaway: 984 a year is the benchmark for a mid-sized site, and it climbs fast once traffic or headcount grows past that mark.
How fast has DSAR volume grown since 2021?
Deletion requests alone are up 567% since 2021, according to DataGrail's 2026 Privacy and AI Trends Report, marking a fifth consecutive all-time-high year for DSR volume. Measured on DataGrail's normalized per-million-identities basis, the broader DSR count rose from 248 in 2021 to 859 in 2023, a 246% three-year increase, per the company's 2024 Data Privacy Trends Report covering more than 700 million records processed in 2023.
Year-over-year growth has not slowed at any point in the data DataGrail has published. The 2023 figure alone represented a 32% jump over 2022, and the newer 2026 report shows the trend still accelerating rather than leveling off.
Figure 3: Six years of DSAR growth across two independent trackers. Source: DataGrail, 2024 and 2026 reports; Termly, 2025 DSAR statistics article.
Nothing in five years of data points toward a plateau. The takeaway: any company still sizing its privacy team for 2021-era request volume is already understaffed.
Which industries receive the most DSARs?
Professional services firms field 4.6 times more DSARs than the average company per year, according to DataGrail's 2026 report, the widest sector gap the company has published. Direct-to-consumer e-commerce retailers carried the heaviest measured load in DataGrail's 2024 report, at 1,577 requests per million identities in 2023, nearly double the 859 average for that year.
Figure 4: Direct-to-consumer e-commerce sites carried the heaviest DSAR load of any sector DataGrail measured in 2023. Source: DataGrail, 2024 Data Privacy Trends Report.
B2B technology companies saw their own DSR volume rise 50% in a single year, 2025, per DataGrail's 2026 report, a sharper single-year jump than the multi-year average across all sectors. Registered California data brokers sit in a category of their own: the average registered broker handled more than 2,000 deletion requests and more than 900 opt-out requests every month, a scale that dwarfs a typical mid-sized company's annual total.
The takeaway: industry, not just company size, decides whether 984 a year is a realistic budget line or a serious underestimate.
What share of DSARs are deletion requests versus access requests?
87% of all data subject requests are deletion requests, according to DataGrail's 2026 report, leaving the remaining 13% split across access, correction, portability, and opt-out requests. That is a shift from a purely access-driven request mix toward one dominated by "forget me" demands, a pattern DataGrail's 2024 report also flagged as the dominant category for a third consecutive year at that point.
Figure 5: Deletion requests now make up the large majority of DSAR volume. Source: DataGrail, 2026 Privacy and AI Trends Report.
A team built to fulfill access requests, which mostly means compiling and exporting data, faces a very different workload than one built to fulfill deletion requests, which means locating and permanently erasing records across every connected system. The takeaway: a privacy team sized for 2022's access-heavy request mix is very likely misallocated for 2026's deletion-heavy one.
How much does it cost to process DSARs manually?
About $1,524 per request, using Gartner's manual-processing cost estimate as cited across DataGrail's reports. Multiplied by the 984-request annual benchmark for a mid-sized company, that works out to roughly $1.5 million a year in DSAR-handling labor alone, before counting the cost of the underlying privacy program.
Figure 6: The per-million-identity cost of manual DSAR processing rose 36% in a single year. Source: DataGrail, 2024 Data Privacy Trends Report, citing Gartner's per-request cost estimate.
That $648,000-to-$881,000 climb, a 36% year-over-year increase, tracks almost exactly with the 32% rise in request volume over the same period, which suggests the per-request cost itself has stayed roughly flat while sheer volume does the damage to a budget. DSAR-handling labor is one line item inside a much larger privacy budget; see our breakdown of privacy compliance costs by company size for how it fits alongside legal review, tooling, and staffing. The takeaway: volume growth, not a pricier process, is what is driving the manual-processing bill upward.
Why do average DSAR counts differ so much between trackers?
Two independent trackers publish very different-looking DSAR averages, and both are defensible once the underlying population is clear. DataGrail measures large and mid-sized enterprise customers and normalizes to a per-million-identities basis; Termly measures its own customer base of small business websites and reports a flat average per site.
| Tracker | What it measures | 2021 baseline | Most recent figure |
|---|---|---|---|
| DataGrail, 2024 Data Privacy Trends Report | DSRs per million identities, 700M+ records analyzed | 248 | 859 (2023, up 246% over three years) |
| DataGrail, 2026 Privacy and AI Trends Report | Deletion requests, indexed to a 2021 baseline | index 100 | index 667 (2025, up 567%) |
| Termly, own DSAR-handling platform | Average requests per customer website | 19.4 | 61.0 (2024, up 215%, across 2,285-plus tracked websites in Q1 2025) |
Neither figure is wrong. DataGrail's enterprise customer base skews toward companies large enough to run millions of tracked identities, where a single automated request-handling tool can process thousands of deletions a month. Termly's customer base skews toward small business websites, where a raw per-site average in the tens of requests a year is the more useful planning number. A solo site owner comparing their own inbound request count against the "average company" headline should benchmark against Termly's per-website figure, not DataGrail's enterprise-scale one.
The Bottom Line
984 requests a year is a real, sourced benchmark, but it describes a mid-sized company with about 5 million monthly visitors, not every business with a privacy policy. The number that matters more than any single average is the trend line: DSR volume has set a new record for five straight years, deletion requests now dominate the mix at 87%, and the cost of handling that volume by hand keeps climbing even where the per-request price has held steady. A company that has not touched its privacy policy's rights-request section since before 2023 is very likely under-describing a process its own team can no longer keep up with manually.
Frequently Asked Questions
How many DSARs does a company receive per year? Companies with roughly 5 million monthly website visitors receive about 984 access and deletion requests a year, according to DataGrail's 2026 Privacy and AI Trends Report. Volume scales with audience size rather than headcount, so a smaller site sees far fewer requests and a larger enterprise sees many more.
How much has DSAR volume grown since 2021? Deletion requests alone are up 567% since 2021, marking a fifth consecutive all-time-high year, per DataGrail's 2026 report. Measured per million tracked identities, overall DSR volume rose from 248 in 2021 to 859 in 2023, a 246% three-year increase, according to DataGrail's 2024 Data Privacy Trends Report.
Which industries receive the most DSARs? Professional services firms field 4.6 times more DSARs than the average company per year, according to DataGrail's 2026 report. Direct-to-consumer e-commerce retailers carried the heaviest measured load in 2023, at 1,577 requests per million identities, per DataGrail's 2024 report.
How much does it cost to process a DSAR manually? About $1,524 per request, using Gartner's manual-processing estimate as cited in DataGrail's reports. That works out to roughly $1.5 million a year for a mid-sized company handling around 984 requests, and the per-million-identity cost basis climbed from $648,000 in 2022 to $881,000 in 2023, a 36% year-over-year increase.
Where the Numbers Come From
- DataGrail. (2026). "Privacy and AI Trends Report 2026: Shadow AI Emerges as a Growing Threat While Core Privacy Challenges Persist." Deletion requests up 567% since 2021, fifth consecutive record year, 87% of DSRs are deletion requests, based on anonymized privacy operations data from hundreds of enterprise customers.
- DataGrail. (2026). "The $1.5M DSR Problem: What DataGrail's Research Found." Professional services firms receive 4.6 times more DSARs than the average company; companies at the 5-million-monthly-visitor tier receive roughly 984 access and deletion requests a year; B2B technology DSR volume up 50% in 2025; registered California data brokers average 2,000-plus deletion and 900-plus opt-out requests monthly.
- DataGrail. (2024). "Brace for Pressure: DataGrail Reports Worldwide Surge in Data Privacy Requests." Findings from the 2024 Data Privacy Trends Report: DSR volume per million identities rose from 248 (2021) to 859 (2023), a 246% three-year increase and 32% year-over-year increase from 2022 to 2023; annual per-million-identity processing cost rose from $648,000 (2022) to $881,000 (2023); analysis covers 700 million-plus records processed between January 1 and December 31, 2023, using a 10% trimmed mean and Gartner's $1,524 per-request manual processing cost estimate.
- Termly. (2025). "40 Essential DSAR Statistics & Trends in 2025." Average requests per customer website rose from 19.4 (2021) to 61.0 (2024); Termly tracked more than 2,285 distinct customer websites receiving DSARs as of the first quarter of 2025.
Note: All figures verified as of August 2026. DataGrail's per-million-identities figures and Termly's per-website average measure different populations and are not directly interchangeable; treat each as a benchmark for companies of a similar profile rather than a single universal average. DSAR volume data is refreshed at least twice a year as DataGrail and Termly publish new report editions.
