Everything below reflects the current release (v1.0.0). Install to first answered request is about ten minutes, most of it spent filling in your own address.
You need WordPress 6.0+ on PHP 7.4+ and an administrator login, plus the plugin zip and licence key from your purchase email. Two honest notes before you run anything. First, this plugin finds and changes personal data, so treat the first run on any site as a dry run and read the result before acting. Second, no tool can promise it found every trace of a person in a database it has never seen; what this one does is search four different ways and tell you which passes ran, so the answer you sign is a considered one.
Go to Plugins → Add New → Upload Plugin, choose the zip from your purchase email, install and activate. It adds a SAR Responder item to the admin menu. Activation changes nothing on the site: it creates the compliance log table and waits.
Open SAR Responder → Licence and paste the key from your purchase email into the licence box. It is a long code starting VPC1., so paste the whole thing rather than typing it. Keys are domain-based, with no account and no phoning home.
Open SAR Responder → Settings and enter the organisation name, your data protection contact, an address and a logo. These appear on exports and, with Pro, on the branded response document. Set the response deadline here too: one calendar month is the law, and 30 days is the safe reading of it.
The meta scan and the custom table scan are both on by default, and that is right for almost every site. On a very large store, if a search feels slow, you can switch either off. The result page then says plainly that it was switched off, so nobody signs off an incomplete answer by accident.
Open SAR Responder → Subject request, type a customer address you know exists, and press Find their data. Do this before you ever need to, on a site you know: the result doubles as a map of where personal data lives on it.
Open SAR Responder → Retention rules, add a rule, press Dry run and read the count before you tick On. Nothing runs on a schedule until you both enable the rule and turn on the daily run.
The behaviours and safeguards you will actually live with.
Four passes against one address: the user account and its meta; comments, including ones left logged out; content they authored; every plugin that registered a WordPress privacy exporter (WooCommerce, WPForms, Gravity Forms, Fluent Forms, Flamingo, Jetpack); post, user and comment meta containing the address; and custom plugin tables holding entries, leads, bookings or orders. Results are grouped by source with the record count on each group.
If a pass was switched off, or an exporter failed, or a plugin returned more pages than one run reads, it is listed as a scope note at the top of the result. Read them before you sign anything. They are the difference between "we searched" and "we searched, and here is what we could not reach".
The zip bundle contains all three formats: JSON for portability under Article 20, CSV for the client, and a readable HTML document for the file. Nothing is written into the uploads folder, so no bundle can be guessed at a URL. CSV values beginning with a formula character are prefixed with an apostrophe so a form field cannot execute in someone's spreadsheet.
Every erasure has a Dry run button that counts exactly what would change and touches nothing. Use it. It costs five seconds and it is the difference between a considered action and a regrettable one.
Anonymising keeps records and removes the person: comments become Anonymous with the address and IP replaced, the user account keeps its ID and role but loses its identifying fields, and matching values in meta and plugin tables are redacted. Deleting removes the records outright. For most erasure requests anonymising is the correct answer, because the transaction usually has to survive even when the customer does not.
A real erasure needs the subject address typed to confirm. The plugin never actions the account you are logged in as, never deletes the last remaining administrator, and never deletes any user who can administer the site, because staff accounts take their authored content with them. Deleting the WordPress user account at all is a separate tick box.
Every search, export, document, anonymisation, erasure and retention run is recorded with the subject, the action, the record count, the admin who ran it, a truncated IP and your note. Use the note field for how you verified identity — that is the question you will be asked. The log exports to CSV and deliberately survives uninstalling the plugin.
Your logo and colours, the reference block, the statutory rights wording, a summary table and the full data as an appendix. It renders as a PDF, or as a print-ready page if you prefer to send it through your own system. What is on it comes from Settings, so fill those in before you generate one.
A rule names what (comments, a plugin table, or the compliance log itself), how old, and whether to delete or anonymise. Table rules only accept tables the search has vetted and a date column that table genuinely has, so a typo cannot point a rule at your users table. Dry-run every rule before arming it.
Administrators by default. If your compliance person should handle requests without full admin rights, the required capability is filterable — wsar_capability — so you can hand SAR duty to a role of your own.
One box, one Save button. Paste the full VPC1.… key from your purchase email. The key covers the number of sites on your plan; move a site by deactivating on one and activating on another. Unlicensed, the free search, export and erasure keep working and only the Pro features pause, with a notice rather than a breakage.