Under GDPR, anyone whose personal data you hold can demand to see it, correct it, delete it, take it with them, or object to what you do with it. You have one month to respond (Article 12(3) — extendable by two more for complex or numerous requests, if you say so within the first month), and under Article 5(2) you must be able to demonstrate you complied with each request.
Most small businesses run this in a shared inbox. That works until the first deadline quietly passes inside a mail thread — and an inbox gives you nothing to demonstrate it with.
The category, priced
The DSAR-portal market has the same two-step shape we keep finding in compliance software:
Enzuzo publishes real numbers: Starter carries 10 automated DSARs a month at $7 billed yearly, or $9 billed monthly — the $9 this page used to quote is the monthly-billed figure rather than the cheapest published one. Above it sit Growth at $22/$29, Pro at $59/$79 and Agency at $99, the last two with unlimited automated requests (re-read 5 September 2026). For a small business, that is honestly cheap.
And there is a tier below all of them that this page had never recorded: a free plan, $0 a month, with three automated DSARs. A business receiving a handful of requests a year fits inside that, and it is the honest first stop — stated plainly here even though the rest of this article recommends buying something. Three a month is a low ceiling, and a low ceiling you never reach costs nothing.
Osano publishes no price at all — its pricing page offers "Schedule a demo with one of our experts" and lists its modules by name (Cookie Consent, Subject Rights Management, Vendor Privacy Risk Management, Data Mapping, Assessments, and a Unified Consent & Preference Hub) without attaching a figure to any of them (read 3 September 2026, re-read 5 September 2026 — still none), placing it with the quote-gated fifth of the market.
So the rented range runs from $9/month to a sales call. Neither number is offensive. The self-hosted argument here is not primarily about money.
The argument the SaaS versions cannot make
A DSAR portal is itself a personal-data processing system. Every request that flows through it carries a name, an email address, the content of the request, and — in the response — potentially everything you hold about that person.
Run that through a third-party SaaS and you have added a processor to your Article 30 record for the tool you bought to manage GDPR. The subprocessor questions, the transfer analysis, the exit terms — the whole data-residency checklist — now apply to your compliance tooling too. There is something structurally odd about answering "who can see the data?" with a system that adds another party who can.
Self-hosted, the requests live in your database on your server, alongside the data they are requests about. The processing chain for your compliance records is: you. That is the clean version of the answer, and it is available for a one-time price.
What the self-hosted version actually is
Privara is a self-hosted GDPR DSAR portal: $79, once. A public request form for data subjects; all five request types — access, deletion, rectification, portability, objection; and a tracking screen that counts every open request down against its statutory deadline, so the one-month clock is a visible number instead of a memory. Email notifications go out through PHP mail() or your own SMTP. Plain PHP 8.1+ (tested on PHP 8.3) and MySQL — if your host runs WordPress, it runs this.
Try the Privara demo ↗Live, on sample data, no sign-up.
The honest limit, in the product's own words: it does not make you GDPR-compliant. It makes you organized — deadlines tracked, requests logged, an auditable record of what was asked and when you answered. Whether your responses are legally sufficient depends on your jurisdiction, your data, and the specifics of each request; a portal cannot know that, and this one does not pretend to. Nothing here is legal advice, and if your volumes or risk are real, counsel is the right spend.
Rented or owned, worked through
Stay with Enzuzo (or similar) if:
- You want the vendor's guidance layer. Hosted compliance products ship templated responses and workflow advice — part of what the subscription pays for is their reading of the regulation.
- You have nobody to run a server. An unmaintained portal is worse than a maintained inbox. Securing a self-hosted business app is the honest checklist; if nobody on the team will do those things, rent.
- Your request volume is enterprise-scale — identity-verification integrations and case management at volume are what the quote-gated end sells.
Own it if:
- Your volume is small but the obligation is real — a handful of requests a year does not justify a permanent subscription, and $79 against $9/month breaks even in nine months.
- You take the structural argument seriously — compliance records with no third party in the chain.
- Assembling the compliance stack anyway — Privara sits in the Compliance Suite beside the whistleblowing channel, the complaints register, the packaging-EPR register and the NIS2 reporting clocks: $299 one-time for all six.
Setting it up without leaking
Three specifics that matter for this category more than most:
- HTTPS is not optional — the request form receives personal data by definition. Any host issues certificates for free now.
- Restrict the admin area by strong password and, where offered, two-factor — the portal's admin sees every request.
- Back up the database and test the restore — a deletion request you can no longer prove you honored is a record-keeping failure of its own. Your backup is not a backup until you have restored it.
The short version
DSARs are a deadline-and-record problem, and an inbox provides neither. Rented portals run $9/month (Enzuzo, cheap and real) to quote-gated (Osano). The self-hosted version costs $79 once, keeps the compliance records out of any third party's hands — the one argument no SaaS in this category can make — and asks in return that you run a server like an adult: HTTPS, updates, tested backups, and a clear-eyed understanding that the tool organizes your compliance rather than granting it.
Next steps
- Privara — the demo is ungated; file a test request and watch the deadline counter pick it up
- The EU data-residency buyer's guide — the full residency/transfer/jurisdiction framework this article applies to one category
- The Compliance Suite — the five compliance apps as one $299 purchase
- The SaaS Price Observatory — Enzuzo, Osano and every other tracked vendor, quoted from their own pages with dates
Competitor prices quoted verbatim from each vendor's own pricing page on the dates shown. GDPR article references are for orientation, not legal advice.