At DataGrail one of the biggest questions we get from our customers and prospects is: “How many data subject requests (DSR or sometimes referred to as DSAR) should I expect per year?”

While we can’t predict the future, we can use the data from the first half of the year to plan for the future, especially as [CCPA enforcement](/content/blog/ccpa-enforcement/index.html) ramps up.

We service DSRs for millions of consumers, giving us unique insights into the number of requests a company can anticipate. We looked at the number of DSRs processed from January to June 2020 across our B2C customers to benchmark approximately how many DSRs a company can expect each month.

Our aim with this research is to help any consumer business (retail, e-commerce, direct-to-consumer, etc.) plan and benchmark where they stand relative to their peers in the space. It’s early, but we hope these learnings help consumer businesses better prepare for CCPA and continuous amendments to the regulation (e.g CPRA).

## Total Volume of Data Subject Requests (DSRs)

In January 2020, we saw a large bump in the number of DSRs submitted across our customer base, which we believe is due to many of them updating privacy policies to comply with CCPA. Since then, we’ve seen the number stabilize around 13 DSRs per million records, per month.

In Figure 1 you can see that in the first half of 2020, we saw a total of approximately 84 total DSR requests per million records, leading us to the conclusion that businesses can expect around 170 DSRs per million records by the end of 2020.

[Gartner data shows](https://www.gartner.com/account/signin?method=initialize&TARGET=http%253A%252F%252Fwww.gartner.com%252Fdocument%252F3981243) that manually processing a single data subject request costs (on average) $1,406. At this rate, **organizations can expect to spend almost $240,000 per million records** to fulfill data subject requests if they are done manually.

## Requests by Type: Access (DSAR), Deletion, Do Not Sell

In Figure 4 we see Do-not-sell (DNS) requests are almost 50% of all DSRs, most likely because consumers are often prompted to accept cookie and DNS settings when they first visit an organization’s website.

When we look at the number and type of DSRs by month (see Figure 5), we see the number of requests start to stabilize. DNS requests stabilize around 7 requests/million records, DSARs sit around 3 requests/million records and deletions stabilize around 4 requests/million records. In June we saw a spike in deletion requests, but it’s unclear as to why. One hypothesis is that many organizations refreshed their privacy policies in advance of the July 1st, 2020 enforcement date, triggering another round of deletion requests.

## Data Subject Request Verification And Potential Fraud

[Fraud comes up as a top concern](https://www.cyberadviserblog.com/2019/10/analysis-verifying-consumer-requests-under-the-ccpa/) when organizations start to think about processing DSRs, especially when personal data is concerned - no organization wants to pass along personal information to the wrong person or someone who might be impersonating one of their customers. To ensure no data ends up in the wrong hands, the CCPA requires that businesses use various methods to verify and authenticate the person is who they claim to be.

Though some platforms ask consumers to provide additional data to verify their identity (which goes against the spirit of CCPA), DataGrail’s [Smart Verification](/content/smart-verification/index.html) technology uses existing data associated with the individual’s record, such as purchase history or user behaviors (e.g. games played, purchases or products viewed) to securely validate the individual’s identity.

With that technology, we were able to see how many unverified (and potentially fraudulent) DSRs went across the platform, which was close to 30%. Three out of every 10 DSR requests will likely not be verified and could be fraudulent attempts at accessing or deleting data.

When we break down which types of requests were unverified (access vs. deletion), we see that access requests (DSARs) make up 70% of the unverified requests, validating the concern that nefarious characters could be making access requests to gain access to another person’s personal information.

When we looked at just DSARs (both verified and unverified) to see what percentage of them were unverified, we saw that 40% of access requests were unverified, and of that, 30% were spam access requests.

## Conclusion

As we look back on the first half of the year, we see that DSR requests are starting to stabilize around 13 DSRs per million records every month. This is an important benchmark to establish as companies continue to plan for resources and budget to get and stay compliant with CCPA for the remainder of 2020 and into 2021.

Without a technology solution in place, handling a single data subject request can potentially involve up to [26 people in an organization](/content/downloads/GDPR-CCPA-cost-report.pdf) and cost $1,406 per request. Financially, that can cost businesses up to $240,000 per million records annually — if they are processing requests manually.

As many in the privacy and security space feared, fraud is a valid concern. While we can’t say for certain that all unverified requests are fraudulent, it’s a fair assumption that a percentage of them are, requiring companies to have a very strong verification method.

At DataGrail, we recommend identifying a verification method that is frictionless for the consumer and does not ask them to submit additional personal information, as that increases an organization’s risk and creates frustration for the consumer.