A Self-Hosted DSAR Portal — Handling GDPR Requests on Your Own Server
Every EU business must answer data-subject requests within a month, and most track them in an inbox. The rented portals run $9 a month to quote-gated enterprise. The self-hosted case has one argument the SaaS versions cannot make — and one honest limit.
Under GDPR, anyone whose personal data you hold can demand to see it, correct it, delete it, take it with them, or object to what you do with it. You have one month to respond (Article 12(3) — extendable by two more for complex or numerous requests, if you say so within the first month), and you must be able to show a regulator how each request was handled.
Most small businesses run this in a shared inbox. That works until the first deadline quietly passes inside a mail thread — and an inbox produces exactly none of the audit trail a regulator asks for.
The category, priced
The DSAR-portal market has the same two-step shape we keep finding in compliance software:
Enzuzo publishes real numbers: Starter at $9/month, including 10 DSARs a month (Growth at $29/month; their pricing page, checked 2026-07-05). For a small business, that is honestly cheap.
Osano publishes no price at all — its pricing page offers "Schedule a demo with one of our experts" (checked 2026-07-05), placing it with the quote-gated fifth of the market.
So the rented range runs from $9/month to a sales call. Neither number is offensive. The self-hosted argument here is not primarily about money.
The argument the SaaS versions cannot make
A DSAR portal is itself a personal-data processing system. Every request that flows through it carries a name, an email address, the content of the request, and — in the response — potentially everything you hold about that person.
Run that through a third-party SaaS and you have added a processor to your Article 30 record for the tool you bought to manage GDPR. The subprocessor questions, the transfer analysis, the exit terms — the whole data-residency checklist — now apply to your compliance tooling too. There is something structurally odd about answering "who can see the data?" with a system that adds another party who can.
Self-hosted, the requests live in your database on your server, alongside the data they are requests about. The processing chain for your compliance records is: you. That is the clean version of the answer, and it is available for a one-time price.
What the self-hosted version actually is
Privara is a self-hosted GDPR DSAR portal: $49, once. A public request form for data subjects; all five request types — access, deletion, rectification, portability, objection; and a tracking screen that counts every open request down against its statutory deadline, so the one-month clock is a visible number instead of a memory. Email notifications go out through PHP mail() or your own SMTP. Plain PHP 8 and MySQL — if your host runs WordPress, it runs this.
The honest limit, in the product's own words: it does not make you GDPR-compliant. It makes you organised — deadlines tracked, requests logged, an auditable record of what was asked and when you answered. Whether your responses are legally sufficient depends on your jurisdiction, your data, and the specifics of each request; a portal cannot know that, and this one does not pretend to. Nothing here is legal advice, and if your volumes or risk are real, counsel is the right spend.
Rented or owned, worked through
Stay with Enzuzo (or similar) if:
- You want the vendor's guidance layer. Hosted compliance products ship templated responses and workflow advice — part of what the subscription pays for is their reading of the regulation.
- You have nobody to run a server. An unmaintained portal is worse than a maintained inbox. Securing a self-hosted business app is the honest checklist; if nobody on the team will do those things, rent.
- Your request volume is enterprise-scale — identity-verification integrations and case management at volume are what the quote-gated end sells.
Own it if:
- Your volume is small but the obligation is real — a handful of requests a year does not justify a permanent subscription, and $49 against $9/month breaks even in under six months.
- You take the structural argument seriously — compliance records with no third party in the chain.
- You are assembling the compliance stack anyway — Privara sits in the Compliance Suite beside the whistleblowing channel, the complaints register, the packaging register and the nexus tracker: $249 one-time for all five.
Setting it up without leaking
Three specifics that matter for this category more than most:
- HTTPS is not optional — the request form receives personal data by definition. Any host issues certificates for free now.
- Restrict the admin area by strong password and, where offered, two-factor — the portal's admin sees every request.
- Back up the database and test the restore — a deletion request you can no longer prove you honoured is a record-keeping failure of its own. Your backup is not a backup until you have restored it.
The short version
DSARs are a deadline-and-record problem, and an inbox provides neither. Rented portals run $9/month (Enzuzo, cheap and real) to quote-gated (Osano). The self-hosted version costs $49 once, keeps the compliance records out of any third party's hands — the one argument no SaaS in this category can make — and asks in return that you run a server like an adult: HTTPS, updates, tested backups, and a clear-eyed understanding that the tool organises your compliance rather than granting it.
Next steps
- Privara — the demo is ungated; file a test request and watch the deadline counter pick it up
- The EU data-residency buyer's guide — the full residency/transfer/jurisdiction framework this article applies to one category
- The Compliance Suite — the five compliance apps as one $249 purchase
- The SaaS Price Observatory — Enzuzo, Osano and 80 others, quoted from their own pages with dates
Competitor prices quoted verbatim from each vendor's own pricing page on the dates shown. GDPR article references are for orientation, not legal advice.