DSAR Form Generator

A data-delete and access request page you can host - GDPR and CCPA wording, no upload, no signup.

100% free. Runs entirely in your browser - your files and data never leave your device and nothing is uploaded to any server.

Template, not legal advice. This is a starting page, not legal advice. Hosting a form does not make you compliant: you still need a process to find, export or delete the data, and to reply within the deadline. Mailto is simple; if you take card data or health data, use a ticket system instead of emailing the request in the clear.

Start from an example

Fills every answer with a worked example you can edit. Pick the one closest to your business.

0 of 5 details filled
Who receives requests
What the page should say

DSAR Form Generator

2 sections · 278 words · updates as you type

DSAR Form Generator

Last updated: 12 November 2026

What this page does

[Your organisation] must let people ask for a copy of their data, a correction, or deletion. This page is that request form for UK/EU GDPR. Host the HTML, link it from your privacy policy and footer, and reply to privacy@example.com within 30 days.

HTML to host

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Privacy request - [Your organisation]</title>
  <style>
    body{font:16px/1.55 system-ui,-apple-system,Segoe UI,sans-serif;max-width:640px;margin:40px auto;padding:0 20px;color:#0f172a}
    h1{font-size:1.6rem} label{display:block;margin:14px 0 6px;font-weight:600}
    input,select,textarea{width:100%;padding:10px 12px;border:1px solid #cbd5e1;border-radius:10px;box-sizing:border-box}
    button{margin-top:18px;padding:12px 18px;border:0;border-radius:10px;background:#4f46e5;color:#fff;font-weight:700;cursor:pointer}
    .note{color:#475569;font-size:0.9rem}
  </style>
</head>
<body>
  <h1>Request your data</h1>
  <p>Use this form to ask [Your organisation] ([your website]) for access, a copy, a correction or deletion of your personal data under UK/EU GDPR. We aim to reply within 30 days. Our privacy policy is at <a href="/privacy">/privacy</a>.</p>
  <form id="dsar" action="mailto:privacy@example.com" method="post" enctype="text/plain">
    <label for="name">Your name</label>
    <input id="name" name="name" required autocomplete="name">
    <label for="mail">Email we should reply to</label>
    <input id="mail" name="email" type="email" required autocomplete="email">
    <label for="type">What are you asking for?</label>
    <select id="type" name="request">
      <option value="access">Access / a copy of my data</option>
      <option value="delete">Delete my data</option>
      <option value="correct">Correct inaccurate data</option>
      <option value="stop">Stop selling or sharing my data</option>
      <option value="port">Export my data in a portable format</option>
    </select>
    <label for="agent">Are you an authorised agent?</label>
    <select id="agent" name="agent"><option value="no">No, this is my own request</option><option value="yes">Yes, I am acting for someone else</option></select>
    <label for="detail">Details (account email, order number, or what we should look for)</label>
    <textarea id="detail" name="details" rows="5" required></textarea>
    <p class="note">We may ask for a copy of ID if we cannot match this request to an account. Do not send ID until we ask.</p>
    <button type="submit">Send request to privacy@example.com</button>
  </form>
  <p class="note">Submitting opens your email app with the request addressed to privacy@example.com. If that fails, write to that address directly.</p>
</body>
</html>

Generated from a template. Not legal advice - read it before you publish or sign it.

Other documents you can generate

Most sites need more than one. A privacy policy without terms, or terms without a refund policy, leaves the obvious gap.

Privacy PolicyA privacy policy written from what your site actually does - GDPR and CCPA sections included only where they apply.Terms and ConditionsTerms of service built around what you actually sell - goods, subscription, downloads or services.Cookie PolicyA cookie policy with a real table - each cookie named, with its purpose and how long it lasts.Cookie Consent BannerGenerates a working consent banner - blocks tagged scripts until consent, Google Consent Mode v2, no dark patterns.Refund and Return PolicyA refund policy customers can follow and payment processors accept - windows, exclusions and statutory rights in plain words.Website DisclaimerA disclaimer that names the actual risk your site carries, plus affiliate and sponsorship disclosures.Accessibility StatementA WCAG accessibility statement that states what you actually meet, names known issues, and gives people a route to report problems.Non-Disclosure AgreementA mutual or one-way NDA with a real purpose clause, standard carve-outs and a defined term.Freelance ContractAn independent contractor agreement that pins down scope, revisions, IP ownership and what happens when payment is late.Data Processing AgreementA GDPR Article 28 processor agreement with the eight mandatory clauses and a filled-in processing schedule.W-9 FormFills a substitute Form W-9 in your browser - your TIN is never uploaded, stored or sent anywhere.1099-NEC Contractor SummaryPrepares a 1099-NEC recipient statement and a payer summary - with a straight answer about what you can and cannot print yourself.Shipping PolicyA shipping policy Shopify and Amazon sellers can publish - origin, times, tracking, duties and who pays.

Jump to the next useful tool without leaving your flow.

See more

About this tool

GDPR and UK GDPR expect a way to make a data request that is as easy as signing up. A privacy policy that only says "email us" is the version regulators treat as friction. This generator builds an embeddable request form that collects the details needed to find someone’s records and confirm who they are, lets the person choose access, correction, deletion or another right, and notes the one-month response time so requests are logged promptly. Publish it the same day as your privacy policy, before the first request arrives. Nothing you type is uploaded.

How to use this tool

  1. Enter your organisation detailsAdd the organisation name, the privacy email that receives requests and your website.
  2. Choose the rights and checksSelect the rights people can request and the identity details you genuinely need.
  3. Embed and test itCopy the code or download the HTML, add it to your privacy page and send yourself a test request.

Handling a data subject access request

Under UK and EU GDPR, people can ask any organisation for a copy of the personal data it holds about them - a data subject access request (DSAR). The organisation generally has one month to respond, can extend that in some complex cases, and usually cannot charge a fee. Requests do not have to use a form or particular words, but a form makes them easier to identify and process.

A good form asks only for what you need to find the data and confirm identity: the requester's name and contact details, any account or customer reference, and what they are asking for. Asking for more ID than necessary can itself be a data protection problem.

Key features

  • Collects the details needed to locate someone's records and verify identity.
  • Lets the requester choose access, correction, deletion or other rights.
  • Notes the one-month response time so requests are logged promptly.
  • Outputs a form you can embed on your privacy or contact page.

Common uses

  • A business with UK or EU customers setting up a GDPR request process.
  • Adding a privacy request form to a website's privacy page.
  • A small team that needs requests to arrive in a consistent format.
  • Logging requests so the one-month deadline is not missed.

Tips for better results

  • Send a test request and check it reaches the person who handles requests, with the date it arrived.
  • Log every request on arrival - the one-month deadline runs from then.
  • Link the form from your privacy policy and account settings.

Mistakes to avoid

  • Hosting the form with no process behind it, so requests sit unanswered past the deadline.
  • Asking for more identity proof than needed, such as a passport scan from a newsletter subscriber.
  • Offering only a mailto link, which leaves no record of when a request arrived.

Frequently asked questions

No. A request is valid in any form, including email, phone or social media. The form makes things easier, but requests that arrive another way still count.

Use proportionate checks - for example, a reply from the email address on the account. Only ask for ID documents when you have real doubt, and the clock is paused until you receive what you need.

A copy of the personal data, plus information such as why you process it, who you share it with, how long you keep it and where it came from. Data about other people must be removed or redacted.

No. It assembles a draft from standard clauses, and every page says so above the preview. Missed deadlines under GDPR are fined as process failures, and CCPA adds a private right of action when deletion is ignored.

Broadly, anyone who collects personal data and needs a page people can use to ask for a copy or deletion. The best time to do it is the same day you publish a privacy policy, not after the first request arrives.

Hosting the form and having no process behind it. The deadline still runs, and a mailto link is not a ticket log.

Most people need Privacy Policy and Data Processing Agreement as well. They cover the gaps this one does not.

Related guides