# DSAR Readiness Check
URL: https://docs.autociso.io/console/privacy/dsar-readiness/
Description: Check which systems and suppliers could hold data about a given subject. The identifier is never stored; only a hash is recorded for audit purposes. Available to Owners and Managers on The Scale plan.

*This is the help text the console shows in the help panel on this page.*

Check which systems and suppliers could hold data about a given subject. The identifier is never stored; only a hash is recorded for audit purposes. Available to [Owners and Managers](https://docs.autociso.io/getting-started/roles-and-permissions/) on [The Scale plan](https://docs.autociso.io/getting-started/plans-and-features/).

### What Is a DSAR?
A Data Subject Access Request (DSAR) is a legal request from an individual to know what personal data you hold about them, how it is used, and with whom it is shared. Under GDPR, organizations must respond within one month.

### How the Readiness Check Works
1. Enter the subject's identifier (email address, customer ID, etc.).
2. Choose the **Subject Category**: Customer, Employee, Prospect or Other.
3. Click **Run Check**.
4. The result lists **Matching Systems** and [**Matching Suppliers**](https://docs.autociso.io/console/directory/suppliers/) (and [**Matching Employees**](https://docs.autociso.io/console/directory/employees/) by ID) that could hold data for this category, to check manually.

### Privacy Guarantee
The raw identifier (for example, an email address) is **never** stored or logged. The [audit trail records only](https://docs.autociso.io/console/settings/audit-trail/):
- A one-way hash of the identifier.
- The subject category.
- The requesting user and timestamp.
- The counts of matches.

### Limits
Checks are limited to 30 per hour per user. The tool shows systems that *could* hold data for this subject category based on the [data categories you have configured](https://docs.autociso.io/console/privacy/data-categories/). It does not confirm that data for this specific person exists; that needs manual verification in each system.