Data subject access requests: clearing the backlog with interim specialists
Get Interim SupportShort answer
A DSAR backlog is a deadline problem: the GDPR requires a response within one month (Article 12(3)), the Swiss Federal Act on Data Protection (FADP) as a rule within 30 days (Article 25(7)). To clear it, triage by deadline, work to a playbook and bring in interim data protection specialists for searches, review and redaction.
Short answer: A DSAR backlog is a deadline problem: the GDPR requires a response within one month (Article 12(3)), the Swiss Federal Act on Data Protection (FADP) as a rule within 30 days (Article 25(7)). To clear it, triage by deadline, work to a playbook and bring in interim data protection specialists for searches, review and redaction.
This guide is for data protection officers, heads of legal and heads of compliance in Switzerland and Germany whose teams can no longer answer access requests on time. It sets out a seven-step plan, the roles in a DSAR backlog support team and the differences between the GDPR and the Swiss FADP.
Why access requests pile up
Access requests pile up when volumes rise and handling depends on a few people without a fixed process. Typical triggers are:
- Employment disputes: current or former employees submit access requests in connection with a dismissal or a claim. These cases often involve emails and documents spread across many systems.
- Events affecting many people: a data breach, a media report or a product change triggers a wave of customer requests in a short time.
- Staffing gap: the person who handled data subject requests is absent or leaves the company.
- No data map: without an up-to-date record of processing activities, simply finding where data sits takes too long.
Overdue responses are not just an administrative issue: data subjects can complain to the supervisory authority, and in employment disputes access requests are often used tactically.
Deadlines and duties: GDPR and Swiss FADP compared
The duties are similar but not identical. The table shows what matters when planning the clean-up.
| Point | GDPR (Germany, EU) | FADP (Switzerland) |
|---|---|---|
| Deadline | Without undue delay and in any event within one month of receipt (Art. 12(3)) | As a rule within 30 days (Art. 25(7)) |
| Extension | By two further months where necessary, taking into account complexity and number of requests; the data subject must be told within one month, with reasons (Art. 12(3)) | No fixed extension rule in the Act; deferral only on the grounds in Art. 26, with reasons (Art. 26(4)) |
| Content | Confirmation, the data, purposes, categories, recipients, storage period, source, rights and further information (Art. 15(1)), plus a copy of the data (Art. 15(3)) | Identity of the controller, the personal data processed, purpose, retention period, source, recipients and further information (Art. 25(2)) |
| Cost | Free of charge; for manifestly unfounded or excessive requests a fee or refusal is possible, with the burden of proof on the controller (Art. 12(5)) | Free of charge; the Federal Council may provide for exceptions (Art. 25(6)) |
| Limits | The copy must not adversely affect the rights and freedoms of others (Art. 15(4)) | Refusal, restriction or deferral, for example where overriding third-party interests apply or a request is manifestly unfounded (Art. 26(1)) |
| Identity | Where there are reasonable doubts, additional information may be requested to confirm identity (Art. 12(6)) | No specific rule in the Act; verify identity carefully before disclosure |
| Service providers | The duty to respond rests with the controller (Art. 12(3)), even when it uses service providers | Where a processor is used, the controller remains obliged to provide information (Art. 25(4)) |
Further differences between the two laws are covered in GDPR vs Swiss FADP.
Clearing a DSAR backlog in seven steps
A backlog clears when deadlines are secured first and cases are then worked through in a fixed process.
- Log the backlog: list every open request with date received, deadline, category (customers, employees, applicants, third parties) and status.
- Triage by deadline: overdue and soon-due cases first. Where the GDPR applies and the conditions are met, notify the extension with reasons within the first month.
- Set the playbook: template responses, identity checks, a list of systems to search, redaction rules and an escalation list for edge cases.
- Search for data: work with IT and business units to search the relevant systems (email, HR system, CRM, file shares) and collect results centrally.
- Review and redact: check third-party data and trade secrets; redact or withhold with documented reasons.
- Quality-check and send: four-eyes review for sensitive cases, secure transmission, documentation of content and date.
- Fix the root causes: update the data map and centralise the intake channel and deadline tracking so that no new backlog builds up.
How to estimate a backlog's volume and track progress is explained in Clearing a contract review backlog; the method transfers well to access requests.
Roles and capacity in the backlog team
A DSAR backlog team typically combines a lead with data protection experience and a processing layer that works to the playbook.
- Senior data protection lawyer (7+ years' experience): sets the playbook and redaction rules, prepares edge cases such as restrictions and refusals for sign-off and aligns with employment law and litigation colleagues.
- Experienced data protection lawyer or privacy specialist (3–6 years): handles cases independently, reviews search results and drafts responses.
- Junior professional (0–2 years): logs requests, tracks deadlines, collects search results and redacts under clear rules.
Sizing the team (worked example): with a 42-hour week and 70% productive time, each full-time professional has roughly 29 hours a week for cases. Multiply open cases per category by the estimated effort per case and divide by those hours and by the weeks left until your target date. Employee requests with large email volumes take many times the effort of simple customer requests, so estimate them separately.
Alpinum Solutions provides data protection lawyers and privacy specialists through staff leasing or freelancing, individually or as a team, part-time or full-time. Under staff leasing, the client company holds the right to give professional instructions and the professional works inside your systems, which is usually the right fit when personal data is accessed. Selected profiles are usually available within 48 hours; the start date is agreed between the company and Alpinum. The service at a glance: data protection and AI governance: interim data protection lawyers and privacy specialists.
Switzerland and Germany: what differs
The process is the same in both countries; deadline, extension and grounds for restriction differ.
- Deadline: the GDPR sets one month with a possible extension; the FADP sets 30 days as a rule. Groups operating in both countries should plan to the shorter deadline.
- Restrictions: the FADP lists the grounds for refusal, restriction or deferral expressly (Art. 26), such as overriding third-party interests or manifestly unfounded or vexatious requests, and requires reasons. The GDPR limits the copy where the rights of others are affected and has a rule on manifestly unfounded or excessive requests.
- Groups: under Art. 26(3) FADP, companies in the same group are not third parties for the purpose of the restriction in paragraph 2.
- Staff leasing: in Switzerland Personalverleih (Swiss staff leasing) with Alpinum Solutions AG as contracting entity; in Germany Arbeitnehmerüberlassung (German temporary agency work) with Alpinum Solutions GmbH (DE).
Limits and risks
- No legal advice from Alpinum: Alpinum is not a law firm. Decisions on restrictions, refusals and responses in ongoing proceedings are taken by the company, with external counsel where needed.
- Accountability stays with the company: the company remains the controller under data protection law. The professionals work under your instructions and in your systems.
- Access and confidentiality: the backlog team sees a lot of personal data. Grant access on a need-to-know basis, log it and revoke it at the end of the assignment.
- Inconsistent responses: without a playbook, different people answer similar cases differently. Agree templates and escalation before the start.
- A new backlog: clearing cases without fixing the causes brings you back to the same point within a few months.
Frequently asked questions about DSAR backlog support
What is the deadline for a data subject access request under the GDPR?
Under Article 12(3) GDPR, the controller must respond without undue delay and in any event within one month of receipt. The deadline can be extended by two further months where the complexity and number of requests make it necessary. The data subject must be told about the extension and the reasons within the first month. In Switzerland, Article 25(7) FADP sets a deadline of 30 days as a rule.
Can external professionals handle access requests?
Yes, provided the company remains the controller and the professionals work under its instructions. Under staff leasing, they are integrated into your organisation and use your systems. Put confidentiality, personal access rights and their revocation at the end of the assignment in place. Decisions to restrict or refuse a request are signed off by someone internal.
How large should a DSAR backlog team be?
That depends on the number and type of open cases and the target date. Multiply open cases per category by the estimated effort per case and divide by productive hours per person per week. Often an experienced lead with one or two professionals is enough; employee requests with large email volumes raise the need considerably.
What needs particular care with employee access requests?
Employees often request emails, personnel files and internal notes. These almost always contain data about other people, whose rights must be taken into account for the copy (Article 15(4) GDPR; in Switzerland Article 26 FADP). Align such cases with employment law colleagues and, where proceedings are ongoing, with whoever runs the litigation.
How do we prevent a new backlog?
With a central intake channel, automated deadline tracking, an up-to-date data map and a playbook with template responses. Define who is responsible in normal operations and plan interim support for events that trigger many requests. An interim assignment can combine clearing the backlog with setting up these processes.
Next step
Alpinum Solutions is the leading provider of interim legal & compliance in the DACH region. Describe your backlog, deadlines and systems, and you will receive selected profiles for staff leasing or freelancing.
- Data protection and AI governance: interim professionals
- Legal support for data protection projects: tasks, roles and process
- Roles & practice areas: all guides on roles and specialisms
- Discuss your needs
Last updated: 10 November 2026.
Related service
Interim data protection professionals for the DPO role, GDPR projects and implementing the EU AI Act.
