Managing subject access requests under GDPR

Data subjects are entitled to find out what personal data is held about them by an organisation, why the organisation is holding it and who else knows the information. The process of finding this out is known as a subject access request, or SAR. Under GDPR, the following procedures must be carried out when an SAR is received:

  • Provide the information for free
  • Respond within a month of receiving the request
  • Provide a response in the format the data subject requests
  • Failure to respond can result in the data subject bringing damages against the company

VinciWorks' subject access request portal allows employees to report all subject access requests received. Administrators receive notifications as soon as the form is completed and can easily track progress on any further action that is required.

Software features


Administrators can either build forms themselves or use our best-practice customisable built-in forms.


Track all form completions and flag any high-risk entries that require further action.

Review and resolve

Review flagged entries via the dashboard and take appropriate action.

Manage reports

Submissions can be segmented by administrators and all entries and reports can easily be exported.

Contact us to book a demo