DSAR Request Form
A data subject access request intake form with identity verification fields, request type selection (access, deletion, correction, portability), and acknowledgement language.
What's included
- Requester identity and contact fields
- Request type selection (access, deletion, correction, portability, objection)
- Relationship to data subject verification
- Regulatory jurisdiction selector
- Supporting documentation upload section
- Acknowledgement and response timeline notice
How to use this template
- Publish the form on a stable URL (ideally /privacy-request or similar). Link it from your main privacy policy, your preference centre and your email footers.
- Add identity verification fields matched to the regulations that apply to you — GDPR allows proportionate verification, CCPA sets specific business-size thresholds, DPDP leaves it to the fiduciary.
- Set up intake automation. The template is a form; it only becomes a workflow when every submission is routed into your DSR tracker with a deadline stamp attached.
- Train your support and legal teams to recognise free-text DSR requests that come in by email or chat — the form captures structured requests but regulators treat an email saying 'please delete my data' as a valid request too.
- Keep the completed form, verification evidence and your response in the DSR evidence file for seven years (or your regulator's statute of limitations).
Download template
Free to download. Just fill in your details.
Need an automated version of this document? TruePrivacy generates and maintains compliance documents automatically as your data processing activities change.
Try TruePrivacy freeFrequently asked questions
What's the right identity verification bar?+
Proportionate to the risk. For an access or deletion request involving sensitive data, two factors (email confirmation plus a signed declaration or ID matching an account email) is the industry baseline. For low-risk requests, a confirmed email is enough.
Should the form support anonymous requests?+
No. Every regulation requires that the controller verify the requester's identity. If you can't link a request to a specific individual's data, you can't fulfil it — refuse with a reason rather than guess.
What about requests made on behalf of someone else?+
The form includes an authorised-agent / representative section. Verify the agent and the authorisation separately — the authorised agent must prove their mandate and the subject must prove they are the data principal.
How do I handle a vexatious or repeated request?+
GDPR Article 12(5) and the DPDP Act both allow controllers to refuse manifestly unfounded or excessive requests, but refusal must be documented. The form's internal fields capture the decision reason and the regulator-facing justification.
Can I charge a fee?+
Only in narrow circumstances. GDPR permits a reasonable fee only for manifestly unfounded or excessive repeat requests. CCPA permits a fee for substantially the same request within 12 months. The default stance is no fee.
Beyond templates: automated compliance
Static templates are a start. TruePrivacy keeps your privacy documentation accurate and up to date automatically.
Free 14-day trial · No credit card required · Setup in minutes