Docs / Portal Overview

Portal Overview

The Public Portal is where data subjects submit GDPR requests directly to your organization. It is also where they follow their request, answer your questions and download the files you send them.

Configure Your Portal →

The requester's view of the portal: email, consent and Send Code
The requester's view of the portal: email, consent and Send Code The requester's view of the portal: email, consent and Send Code

What is the Public Portal?

The Public Portal is a web page where anyone can submit a data subject request to your organization. You create the portal link in Settings > Integrations, and you can have more than one link (for example one for your website and one for a campaign).

Key Features

How It Works

For Data Subjects

  1. Visit your portal - Open your portal link
  2. Enter email - Type their email address under Enter your email, tick I have read and agree to the Privacy Notice. and click Send Code
  3. Verify - Enter the code from the email under Enter code from email and click Verify
  4. Submit request - On the Create New Request tab, enter Your Full Name, choose a Request Type, optionally add Additional Details (Optional) (up to 500 characters) and click Submit Request
  5. Confirmation - The portal opens the Your Cases tab, which lists the new case with its 8-character Case ID, type, status and due date. SAR Portal also emails the requester a confirmation
  6. Answer questions - If you request information, the requester signs in again, opens the case and replies under Submit Your Response, optionally attaching documents
  7. Track status and download files - The requester returns with the same link, signs in with a new code and opens View Details on the case

A requester who already has cases lands on the Your Cases tab after verifying. New requesters land on Create New Request.

For Your Organization

  1. Notification - Users with the Admin or Case Manager role receive an email when a new request arrives
  2. Case created - The request becomes a case with the status Open
  3. Email confirmed - The requester proved they control the email address (see Identity verification on portal cases)
  4. Process normally - Handle it like any other case

Portal URL

Your portal link is token-based:

https://app.sarportal.com/subjectaccess?token={your-portal-token}

Create and copy the link in Settings > Integrations > Public Portal Access. The same link is used to submit a request and, later, to track it and download files. See Embedding on Your Site for managing links, expiry dates and the iFrame embed.

Submitting through the portal is optional. You can also log requests that arrive by email or post directly as cases. The portal automates intake and email verification.

Portal Elements

In embedded mode (iFrame) the header shows only “Subject Access Request”.

Sign-in Form

After Verification

Three tabs:

The standalone portal shows a two-part footer:

In embedded mode the footer is one line: “GDPR Compliant: Processed by SAR Portal on behalf of {your company name}” with a Privacy link.

Compliance Features

GDPR Article 28 Notice

The portal states that:

The consent text links to SAR Portal’s privacy notice. This link cannot be changed. To point requesters at your own privacy policy, put its address in your Email Footer; the standalone portal footer shows it, and web addresses become clickable links.

The requester must tick I have read and agree to the Privacy Notice. before Send Code becomes available.

Email Verification

Why Verification?

Verification Flow

  1. The requester enters their email address and clicks Send Code
  2. SAR Portal emails a one-time code
  3. The requester enters the code and clicks Verify
  4. The portal shows “Verified. Showing your cases.”

Code Details

Identity Verification on Portal Cases

When a requester verifies with a code, SAR Portal records “Email One-Time Password” as the verification method on their existing cases that have no method yet. A case submitted during the same visit gets this method the next time the requester signs in with a code. Until then, use Mark Verified on the case if the email check is enough for you. See Identity Verification.

Request Types Available

The Request Type list shows the types you enabled in Settings > Case Management > Enabled Request Types. If none are set, all eight are offered:

Request Type GDPR article
Access Request Article 15
Erasure Request Article 17
Rectification Request Article 16
Objection Request Article 21
Restriction Request Article 18
Portability Request Article 20
Automated Decision Objection Article 22
Other -

Tracking Status & Downloading Files

The portal is not only for submitting. The requester follows the request through to completion there.

On the Case Details Tab

When Files Appear

Files do not wait for the case to be closed. A document appears in the portal as soon as you attach it to the case through Request Info or Close Case, and documents the requester uploaded are listed too. Every download is recorded in your audit trail.

For the requester’s step-by-step guide, see Downloading Your Files.

Delivering the Response

When you close the case, attach the response documents in the Close Case dialog. The requester is emailed and can return to the portal link to download them. Only someone who verifies with the requester’s email address can see the case. See Case Actions.

When the Portal Refuses a Request

Situation What the requester sees
The portal link expired or was decommissioned “Invalid, expired, or decommissioned token. Please request a new link from the organization.”
Your plan’s monthly case limit is reached (portal requests get no extra allowance) “Unable to submit request at this time. Please contact the organization directly for assistance.”
A payment is past due (from day 0) The same “Unable to submit request at this time…” message. Existing cases can still be viewed
Your account is inactive “Access temporarily unavailable. Please contact {your company name} directly for assistance with your data request.”
The requester’s browser blocks Google’s security check (usually an ad blocker or privacy extension) “Security verification couldn’t load. This is usually caused by a browser extension (ad blocker or privacy tool). Please disable it for this site, or try again in a private/Incognito window.”

Adding the Portal to Your Website

Link to the portal from your privacy policy, a dedicated page or your footer, or embed it with an iFrame. See Embedding on Your Site for the code.

Portal vs Manual Requests

Aspect Portal Manual (Email/Letter)
Case Creation Automatic Manual entry required
Email Verification Built-in (one-time code) You must verify
Audit Trail Recorded automatically Recorded once you log the case
Data Collection Structured (name, type, details) Variable format
Information requests Answered in the portal By email or post

Next Steps