DSAR software FAQ: security, discovery, disclosure, and legal

Security is our design priority because Obtainer touches personal data. The intended posture is encryption in transit and at rest, secure delivery of a completed response to the requester rather than raw email attachments, a published sub-processor approach, and data-residency options on higher tiers. We describe this as the product posture we build to, not as a certification we are claiming to already hold, and we will not display a badge we have not earned. If a specific control or region matters for your program, ask us before you buy.

Obtainer's discovery is built to search across your connected systems and compile what it finds into one reviewable manifest, and because a human reviews that manifest, you can add a system or a record it did not reach. Discovery completeness is the real gap most tools leave open, so we address it directly: we help you be thorough, and you confirm completeness. We do not claim to magically find every byte in your organization with no input; we make the data you hold visible in one place so a person can verify it.

No, by design. Nothing is released automatically. Obtainer compiles the records and drafts the response, then a human reviews the manifest, redacts third-party and exempt data behind a redaction bar, and approves before anything ships. The AI is an assistant that surfaces candidates; it is not an autonomous discloser. You stay in control of exactly what is disclosed, which is the direct answer to the over-disclosure fear.

No. Obtainer helps you comply by automating the mechanics of a DSAR: intake, data discovery, drafting, and deadline tracking. The legal judgments, such as which exemptions apply, what a valid identity check requires, whether a request can be refused, and your retention obligations, stay with your team. We are a tool, not your lawyer, and we say so plainly wherever it matters.

You do not need a mature data-governance program or a finished data map first. Obtainer is built to start finding data across common systems without one, so you can run a request early and expand coverage over time. Most workflow tools assume you already have a data map and leave the hard discovery to you; Obtainer leads with discovery so you can get value on your first request.

Those bundle DSAR into a sprawling governance platform with sales-led onboarding and enterprise pricing. OneTrust now commonly carries a minimum around $10,000 a year, and DataGrail often runs into tens of thousands. Obtainer does DSAR fulfillment and only that, self-serve, at a published price, built for the teams those suites priced out. You are not buying cookie consent, vendor risk, and policy management you did not ask for.

Yes. Obtainer tracks the statutory clock per law, one month for GDPR and 45 days for CCPA, and drafts from the template that matches the request's jurisdiction, so the deadline and the response match the law that applies. During this phase the demo on the site uses clearly illustrative sample requests, not a live discovery run.

Transparent self-serve pricing, billed yearly by default. Starter is $49 per month, Growth is $149 per month and is the most popular tier, Business is $399 per month, and Enterprise is custom for larger and regulated organizations. There is no free plan; the interactive demo on this page is the free way to try it. These plans sit far under OneTrust's roughly $10,000 floor and DataGrail's tens of thousands a year, because Obtainer is focused on DSAR fulfillment rather than a full governance suite.