DSAR Form Generator

A data-delete and access request page you can host - GDPR and CCPA wording, no upload, no signup.

100% free. Runs entirely in your browser - your files and data never leave your device and nothing is uploaded to any server.

Template, not legal advice. This is a starting page, not legal advice. Hosting a form does not make you compliant: you still need a process to find, export or delete the data, and to reply within the deadline. Mailto is simple; if you take card data or health data, use a ticket system instead of emailing the request in the clear.

Start from an example

Fills every answer with a worked example you can edit. Pick the one closest to your business.

0 of 5 details filled
Who receives requests
What the page should say

DSAR Form Generator

2 sections · 278 words · updates as you type

DSAR Form Generator

Last updated: 13 September 2026

What this page does

[Your organisation] must let people ask for a copy of their data, a correction, or deletion. This page is that request form for UK/EU GDPR. Host the HTML, link it from your privacy policy and footer, and reply to privacy@example.com within 30 days.

HTML to host

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Privacy request - [Your organisation]</title>
  <style>
    body{font:16px/1.55 system-ui,-apple-system,Segoe UI,sans-serif;max-width:640px;margin:40px auto;padding:0 20px;color:#0f172a}
    h1{font-size:1.6rem} label{display:block;margin:14px 0 6px;font-weight:600}
    input,select,textarea{width:100%;padding:10px 12px;border:1px solid #cbd5e1;border-radius:10px;box-sizing:border-box}
    button{margin-top:18px;padding:12px 18px;border:0;border-radius:10px;background:#4f46e5;color:#fff;font-weight:700;cursor:pointer}
    .note{color:#475569;font-size:0.9rem}
  </style>
</head>
<body>
  <h1>Request your data</h1>
  <p>Use this form to ask [Your organisation] ([your website]) for access, a copy, a correction or deletion of your personal data under UK/EU GDPR. We aim to reply within 30 days. Our privacy policy is at <a href="/privacy">/privacy</a>.</p>
  <form id="dsar" action="mailto:privacy@example.com" method="post" enctype="text/plain">
    <label for="name">Your name</label>
    <input id="name" name="name" required autocomplete="name">
    <label for="mail">Email we should reply to</label>
    <input id="mail" name="email" type="email" required autocomplete="email">
    <label for="type">What are you asking for?</label>
    <select id="type" name="request">
      <option value="access">Access / a copy of my data</option>
      <option value="delete">Delete my data</option>
      <option value="correct">Correct inaccurate data</option>
      <option value="stop">Stop selling or sharing my data</option>
      <option value="port">Export my data in a portable format</option>
    </select>
    <label for="agent">Are you an authorised agent?</label>
    <select id="agent" name="agent"><option value="no">No, this is my own request</option><option value="yes">Yes, I am acting for someone else</option></select>
    <label for="detail">Details (account email, order number, or what we should look for)</label>
    <textarea id="detail" name="details" rows="5" required></textarea>
    <p class="note">We may ask for a copy of ID if we cannot match this request to an account. Do not send ID until we ask.</p>
    <button type="submit">Send request to privacy@example.com</button>
  </form>
  <p class="note">Submitting opens your email app with the request addressed to privacy@example.com. If that fails, write to that address directly.</p>
</body>
</html>

Generated from a template. Not legal advice - read it before you publish or sign it.

Other documents you can generate

Most sites need more than one. A privacy policy without terms, or terms without a refund policy, leaves the obvious gap.

Privacy PolicyA privacy policy written from what your site actually does - GDPR and CCPA sections included only where they apply.Terms and ConditionsTerms of service built around what you actually sell - goods, subscription, downloads or services.Cookie PolicyA cookie policy with a real table - each cookie named, with its purpose and how long it lasts.Cookie Consent BannerGenerates a working consent banner - blocks tagged scripts until consent, Google Consent Mode v2, no dark patterns.Refund and Return PolicyA refund policy customers can follow and payment processors accept - windows, exclusions and statutory rights in plain words.Website DisclaimerA disclaimer that names the actual risk your site carries, plus affiliate and sponsorship disclosures.Accessibility StatementA WCAG accessibility statement that states what you actually meet, names known issues, and gives people a route to report problems.Non-Disclosure AgreementA mutual or one-way NDA with a real purpose clause, standard carve-outs and a defined term.Freelance ContractAn independent contractor agreement that pins down scope, revisions, IP ownership and what happens when payment is late.Data Processing AgreementA GDPR Article 28 processor agreement with the eight mandatory clauses and a filled-in processing schedule.W-9 FormFills a substitute Form W-9 in your browser - your TIN is never uploaded, stored or sent anywhere.1099-NEC Contractor SummaryPrepares a 1099-NEC recipient statement and a payer summary - with a straight answer about what you can and cannot print yourself.Shipping PolicyA shipping policy Shopify and Amazon sellers can publish - origin, times, tracking, duties and who pays.

Jump to the next useful tool without leaving your flow.

See more

About this tool

DSAR Form Generator builds a dsar form from your answers to a short questionnaire. It is for anyone who collects personal data and needs a page people can use to ask for a copy or deletion, and the right moment is the same day you publish a privacy policy, not after the first request arrives. GDPR and UK GDPR expect a request route that is as easy as signup. A privacy policy that says "email us" without a form is the version regulators treat as friction. Nothing irrelevant is included. A clause that does not apply to you is omitted, not padded - a form describing something you do not do is a problem in its own right. Nothing is uploaded. The whole thing is assembled locally, so confidential details stay on your machine and there is no account to create or delete later.

How to use this tool

  1. Answer the questionsOrganisation name. Privacy email that receives requests. Website address. Nothing you type leaves the browser.
  2. Watch it assembleClauses appear and disappear as you answer, so the form matches what you actually do rather than a generic template.
  3. Copy or downloadCopy the code, or download the HTML file and paste it into your site.

Key features

  • Built from your answers, so clauses you do not need are left out rather than padded.
  • Outputs working code you can paste, not instructions to implement it yourself.
  • Runs entirely in your browser. Nothing uploaded, nothing stored, no account.
  • Says plainly what it is and is not, above the preview rather than in a footer.
  • Free with no watermark, no email wall and no per-document limit.

Common uses

  • Preparing what a client, an app store or a payment processor has asked to see.
  • Anyone who collects personal data and needs a page people can use to ask for a copy or deletion.
  • Getting something in place the same day you publish a privacy policy, not after the first request arrives.
  • Giving a lawyer a draft to review rather than paying them to start from nothing.
  • Replacing a copied form that describes a different business.

Tips for better results

  • Read it before you publish it. It is a draft built from standard clauses, and you are the only person who knows whether every line is true of you.
  • Download the Word version if you expect to edit it. The PDF is for publishing; the .docx is for changing.
  • Keep a copy of each version with its date. When someone asks what your terms said last March, the answer needs to be a file rather than a memory.
  • Test with developer tools open. If a tracking cookie appears before you click Accept, a script is still loading outside the blocker.

Mistakes to avoid

  • Hosting the form and having no process behind it. The deadline still runs, and a mailto link is not a ticket log.
  • Leaving the placeholder text in. Anything in square brackets is a field you skipped, and readers spot them immediately.
  • Treating a generated draft as a reviewed one. This is a starting point, and where the stakes are real it is worth a professional reading it.
  • Assuming the banner blocks trackers by itself. It blocks what you tag; anything untagged keeps firing.

Frequently asked questions

Answer the questions on the left. The form builds as you type, and you can copy it, or download it as PDF, Word or plain text when it looks right.

No. It assembles a draft from standard clauses, and every page says so above the preview. Missed deadlines under GDPR are fined as process failures, and CCPA adds a private right of action when deletion is ignored.

Yes - free, no signup, no email required and no watermark. It runs in your browser, which is why it costs nothing to provide.

No. Everything happens on your device - nothing is sent to a server, nothing is stored, and closing the tab clears it.

Broadly, anyone who collects personal data and needs a page people can use to ask for a copy or deletion. The best time to do it is the same day you publish a privacy policy, not after the first request arrives.

Hosting the form and having no process behind it. The deadline still runs, and a mailto link is not a ticket log.

Most people need Privacy Policy and Data Processing Agreement as well. They cover the gaps this one does not.

People also search for

  • dsar form generator no signup
  • dsar form generator template
  • free dsar form generator
  • dsar form generator uk
  • dsar form generator usa
  • dsar form generator
  • dsar form generator for small business

Related guides