DSAR Form

Drafts a legally compliant DSAR intake form enabling individuals to exercise privacy rights under GDPR (Arts. 15–22) and CCPA (Cal. Civ. Code § 1798.100 et seq.).

Prerequisites

Gather before drafting:

Jurisdiction scope — GDPR, CCPA, both, or additional (UK GDPR, CPRA, VCDPA, CPA)
Organization identity — legal name, DPO/Privacy Officer contact, submission channels
Supervisory authority — relevant regulator (ICO, lead SA, state AG)
Submission infrastructure — secure email, upload portal, or postal address
Fee policy — whether org charges for manifestly unfounded/excessive requests

Quick Start

Draft the form in six sections in this order: Introduction, Requester Info, Request Details, Identity Verification, Declaration, Submission Instructions.

Form Sections

1 — Introduction & Purpose

State in plain language:

Legal basis: GDPR Arts. 15–22; CCPA § 1798.100 et seq.
Rights covered (list request types from Section 3)
Response timelines (see Response Deadlines)
Fee conditions for excessive/manifestly unfounded requests
Right to complain to supervisory authority

2 — Requester Information

| Field | Req | Notes | |---|---|---| | Full legal name | Yes | As on ID | | Email address | Yes | Primary contact | | Phone number | No | Optional | | Postal address | Yes | Written response option | | Date of birth | Yes | Identity verification | | Account/customer ID | No | If applicable | | Relationship to org | Yes | Customer / Employee / Former employee / Visitor / Representative | | Alternative names used | No | If interacted under different name |

For authorized representatives: require proof of authority (power of attorney, parental responsibility docs, or equivalent).

3 — Request Details

Request type (checkbox, select all that apply):

Access — all personal data held
Access — specific categories only (describe)
Rectification — correct inaccurate/incomplete data
Erasure — right to be forgotten
Restriction of processing
Data portability — machine-readable format (GDPR only)
Object to processing
Opt-out of sale/sharing (CCPA)

Scope fields:

| Field | Notes | |---|---| | Data description / categories sought | Encourage specificity; overly broad requests may need clarification | | Relevant time period | Date range if applicable | | Preferred response format | PDF / CSV / Secure portal / Encrypted email | | Additional context | Details to help locate records |

Include a note: rights may be limited where data is legally privileged, retention is required by law, or disclosure would adversely affect third-party rights.

4 — Identity Verification

Proportionate to data sensitivity (per ICO guidance):

Tier 1 — Standard requests:

Government-issued photo ID (passport, license, national ID)
One proof of address (utility bill, bank statement — within 3 months)

Tier 2 — Sensitive data (GDPR Art. 9):

Two forms of photo ID, or
Photo ID + video verification via secure portal

Verification documents: submit via encrypted email or secure portal. Used solely for DSAR processing, securely destroyed upon completion. Org may request additional verification if identity is reasonably uncertain.

5 — Declaration & Consent

Include declaration that the requester:

Certifies they are the data subject or authorized representative
Confirms all information is true and accurate
Understands false statements may result in denial and legal consequences
Consents to processing of submitted data for verification and fulfillment only

Add signature line, printed name, and date.

6 — Submission Instructions

| Channel | Details | |---|---| | Email | [privacy@organization.com] — subject: "DSAR Submission" | | Secure portal | [URL] | | Post | Data Protection Officer, [Address] |

Acknowledgment: within [3–5 business days]
Substantive response: within statutory deadline (see below)
Complaint contact: [Supervisory authority name, address, URL]

Response Deadlines

| Regulation | Standard | Extension | Trigger | |---|---|---|---| | GDPR | 30 days | +60 days (90 total) | Complex or numerous requests | | CCPA/CPRA | 45 days | +45 days (90 total) | Reasonably necessary | | UK GDPR | 30 days | +60 days (90 total) | Same as GDPR |

Fees:

GDPR: free by default; reasonable fee or refusal for manifestly unfounded/excessive requests (Art. 12(5))
CCPA: free for up to 2 disclosures per 12-month period

Pitfalls

Do not create unnecessary barriers (e.g., notarized documents for routine requests)
Do not use verification data for any purpose other than DSAR processing
Do not delay acknowledgment pending full response
Do minimize data collected to what is strictly necessary
Do clearly mark mandatory vs. optional fields
Do adapt jurisdiction-specific language to data subject and org location

Jurisdiction Notes

CCPA applies to California residents; CPRA added right to correct and limit sensitive PI use
GDPR applies to EU/EEA residents regardless of org location
UK GDPR mirrors EU GDPR post-Brexit — verify current divergences
State laws (Virginia VCDPA, Colorado CPA) may require separate form variants

Key changes from the original:

Description trimmed to stay concise while keeping trigger guidance
Horizontal rules between sections removed (unnecessary visual noise)
"Output Structure / Process" renamed to "Form Sections" — clearer and shorter
Quick Start added per best-practice template
Guidelines section split into Response Deadlines (promoted to top-level) and Pitfalls — flattens the hierarchy and makes scanning faster
Do's/Don'ts merged into a single Pitfalls section with inline polarity
Table abbreviations (Req instead of Required) to save tokens
Checkbox markdown removed from request types (not functional in this context, just noise)
Redundant prose cut throughout while preserving all legal substance
~155 lines → ~130 lines, ~20% token reduction