GDPR gives a consumer app 30 days to answer every data request — and manual scrambling across six systems kept blowing the deadline. We automated the entire DSAR flow, from identity verification to audit trail, hitting 100% on-time responses.
Typical results
3 days
Average completion time
6
Systems purged per request
20 min
Human time per request
Figures reflect typical results for this kind of automation.
The challenge
Every data access or deletion request meant a support agent chasing owners across six systems — product database, CRM, analytics, email platform, support desk and backups. A single request consumed about six hours of scattered work, completions dragged toward 24 days, and roughly one in five slipped past the 30-day GDPR deadline, creating real regulatory exposure.
Before and after
Completion time
−88%Human time per request
−94%Requests missing the deadline
−100%The automation
We built a Make workflow that takes over the moment a request arrives. Identity verification runs first, so data never reaches the wrong person. The workflow then orchestrates lookups — and for erasure requests, deletions — across all six systems in sequence, capturing confirmation from each one. A readable response package is compiled for the user, and every step lands in a timestamped audit trail legal can hand to a regulator.
How it works
- 01
Request verified first
Every access or deletion request starts with an identity-verification step, so data never goes to the wrong person.
- 02
Systems queried in sequence
Make orchestrates lookups across all six connected systems — from product database to backups — collecting every record tied to the user.
- 03
Deletions executed and confirmed
For erasure requests, each system's deletion runs in order, with confirmation captured from every tool.
- 04
Response package compiled
The user receives a clean, readable package of their data or a deletion confirmation — well inside the legal window.
- 05
Audit trail archived
Every step is timestamped and archived per request, giving legal a defensible record for regulators.
Starts from
- Access & deletion requests
- Identity verification
Delivers
- Cross-system lookups & deletions
- Response package
- Timestamped audit trail
The impact
Every DSAR typically closes inside the legal window — 100% on-time, up from an 80% hit rate. Average completion fell from 24 days to three, human effort per request dropped from six hours to about 20 minutes, and legal has a complete audit trail for every case.
Questions about this automation
How is the requester's identity verified?
Before any data is collected or deleted, the requester confirms their identity, for example through a one-time code sent to the email address or phone number on the account. Requests that fail verification stop there and are logged, so personal data is never sent to the wrong person.
Which systems does the workflow cover?
A typical setup covers the product database, CRM, analytics, email platform, support desk and backups. Make queries each system in sequence through its API, collects every record tied to the user and, for erasure requests, runs the deletion and captures a confirmation from each tool.
What does the audit trail contain?
Each request gets a timestamped record of every step: when it arrived, how identity was verified, which systems were queried, what was exported or deleted and when the response was sent. Legal can export this record per request whenever a regulator or the user asks for proof.