How a SAR Flows Through Fisar
Every request moves through the same six stages, from acknowledgement to delivery, with your DPO approving the result before anything is released.
Whichever type of request you create, Fisar runs it through the same six stages. You can watch progress live from SAR Monitoring.
The six stages
Acknowledgement
The request is logged and the 30-day clock starts from the recorded date of receipt.
ID Verification
The requester's identity is confirmed and the outcome recorded before any data is gathered.
Data Gathering
Fisar queries your connected systems - email, files, chats - and collects everything relating to the individual.
Data Transformation
Results are normalised into reviewable formats. Emails become PDFs; duplicates are removed.
Review & Redaction
Fisar identifies every person referenced, decides what belongs to the requester and what belongs to a third party, and applies redactions.
Response Delivery
Once your DPO verifies the redactions, the response is packaged and released to the requester.
What you see on a request
| Field | Meaning |
|---|---|
| Days Remaining | Time left against the statutory 30-day deadline |
| Due Date | Calculated from the recorded date of receipt |
| Data Collection | Whether gathering has finished |
| SAR Progress | Current stage, plus a Not Verified badge until your DPO signs off |
| Time Taken | How long Fisar spent processing |
| SAR Password | The password for the secure archive, retrievable at any time |
Forgotten the password you set? It is stored against the request. Open the SAR and reveal it under SAR Password - you do not need to remember it.
The human checkpoint
Stage six does not happen on its own.
A completed SAR sits at Redaction Completed / Not Verified until a person downloads the archive, inspects the redactions, and clicks Verify Redaction. Only then can the response be sent.
Fisar never releases a response by itself. Verification is a deliberate, recorded action taken by your DPO.
After delivery
The requester receives an email containing a secure download link. The archive is password-protected, and the password must be shared separately - by phone or another channel, not in the same email.
Download links remain valid for 30 days.