dsar-form

DSAR Form

Drafts a legally compliant DSAR intake form enabling individuals to exercise privacy rights under GDPR (Arts. 15–22) and CCPA (Cal. Civ. Code § 1798.100 et seq.).

Prerequisites

Gather before drafting:

1. Jurisdiction scope — GDPR, CCPA, both, or additional (UK GDPR, CPRA, VCDPA, CPA)
2. Organization identity — legal name, DPO/Privacy Officer contact, submission channels
3. Supervisory authority — relevant regulator (ICO, lead SA, state AG)
4. Submission infrastructure — secure email, upload portal, or postal address
5. Fee policy — whether org charges for manifestly unfounded/excessive requests

Quick Start

Draft the form in six sections in this order: Introduction, Requester Info, Request Details, Identity Verification, Declaration, Submission Instructions.

Form Sections

1 — Introduction & Purpose

State in plain language:

• Legal basis: GDPR Arts. 15–22; CCPA § 1798.100 et seq.
• Rights covered (list request types from Section 3)
• Response timelines (see Response Deadlines)
• Fee conditions for excessive/manifestly unfounded requests
• Right to complain to supervisory authority

2 — Requester Information

Field	Req	Notes
Full legal name	Yes	As on ID
Email address	Yes	Primary contact
Phone number	No	Optional
Postal address	Yes	Written response option
Date of birth	Yes	Identity verification
Account/customer ID	No	If applicable
Relationship to org	Yes	Customer / Employee / Former employee / Visitor / Representative
Alternative names used	No	If interacted under different name

For authorized representatives: require proof of authority (power of attorney, parental responsibility docs, or equivalent).

3 — Request Details

Request type (checkbox, select all that apply):

• Access — all personal data held
• Access — specific categories only (describe)
• Rectification — correct inaccurate/incomplete data
• Erasure — right to be forgotten
• Restriction of processing
• Data portability — machine-readable format (GDPR only)
• Object to processing
• Opt-out of sale/sharing (CCPA)