Most restaurants don't. And that's a GDPR fine waiting to happen. SAR Portal gives you a simple system to handle data requests professionally — before they become problems.
A disgruntled customer. A former employee. A competitor looking to cause trouble. Anyone can submit a Data Subject Access Request (DSAR) asking for all the personal data you hold on them.
You have 30 days to respond. Miss the deadline or respond incorrectly, and you're looking at a complaint to the Data Protection Commission — and potential fines starting at €10,000.
"We thought we'd never get a DSAR. Then we got three in one month after a bad TripAdvisor review. We had no system in place and it was chaos."
— Restaurant owner, Dublin
These requests are more common than you think
A customer who used your online booking system wants all their reservation history, contact details, and any notes staff made about them. You need to search ResDiary, your POS, email, and any notebooks.
A former loyalty programme member wants to be forgotten. You need to remove them from Deliveroo, Just Eat, your mailing list, reservation system, and any spreadsheets — while keeping records you legally must retain.
Someone claims they slipped in your premises. They're requesting CCTV footage as part of a potential claim. You need to provide it within 30 days — but blur out other customers first.
A former employee who left on bad terms wants their personnel file, training records, performance notes, and any emails about them. You need to redact information about other staff members.
Most restaurant owners underestimate how much they collect
Names, phones, emails, party sizes, special requests
Addresses, order history, payment info, preferences
Health data — highest GDPR sensitivity
Purchase history, points, contact details
HR files, rotas, payroll, references
Customers, staff, delivery drivers
Handle any data request in minutes, not days
Give customers a proper place to submit requests instead of random emails. OTP verification confirms their identity before you share anything.
Upload exports from your systems. Our AI scans for names, emails, phone numbers, addresses — and flags what needs attention.
Before you share data, AI blacks out other people's information. Other customers' names in a reservation list? Gone. Other staff in HR notes? Redacted.
Every action is logged. If the DPC ever asks how you handled a request, you have timestamped proof of every step.
SAR Portal Basic costs less than a single consultation with a data protection solicitor. Handle DSARs professionally and on time, every time — with complete audit trails for your records.
14-day free trial. No credit card required.