A data subject access request form, on your own trust center
A data subject access request (DSAR) form gives people one place to ask for their data. Notice Labs puts a privacy request form on your trust center, at your own domain. Someone picks what they want (access, deletion, correction, export or something else) and describes it. Your privacy contact gets it by email, and the admin keeps it as a record.
From £39 a month. No sales call.
Privacy requests arrive with nowhere to land
Someone who wants to see, correct or delete their data looks for a form or a named contact. Without one, the request goes to support or sales, gets forwarded a few times, and the clock the requester expects has already started before anyone who can act on it sees it.
A buyer's security questionnaire asks the same question from the other side: how do people submit a data subject access request, and who handles it. A form on your trust center, with a record behind it, answers both.
How a request travels
- 01
Set your privacy contact
Choose the address that receives privacy requests. It can be a shared inbox, a person, or an alias into your ticketing tool.
- 02
People use the form
Every trust center has a privacy request form: name, email, the type of request and a description. It opens from a link of its own, such as trust.yourcompany.com/#privacy-request.
- 03
Both sides hear back
Your contact gets the request by email, with reply-to set to the requester. The requester gets an acknowledgement once they submit.
- 04
Keep the record
Requests sit in the admin with their type and submission date, so you can see what's outstanding and what's been handled.
One form, five request types
The form asks what the request is for: access, deletion, correction, export or something else. Then a name, an email and a description. That's enough for your team to start working the request without a back-and-forth just to find out what's being asked.
A list of requests, not a scattered inbox
Each request is a row with its type, the requester's message and the date it came in, so it's clear what still needs an answer and what's already handled.
What it doesn't do
Notice Labs doesn't fulfil the request for you. It doesn't search your systems for someone's data, delete it, or generate an export file. Once a request lands in your admin, your team works it: verifying identity, finding the data and replying within whatever deadline applies.
It gives requesters a findable way to reach you and gives you a record of every request and when it arrived. Rights and deadlines vary by law and by who's asking, so check what applies to your business rather than treating this page as legal advice.
Questions
Straight answers to what people ask before they set this up.
What is a data subject access request?
A request from someone asking to see, correct, delete or receive a copy of the personal data a company holds about them. Laws including the GDPR, the UK GDPR and the CCPA give people these rights in some form, though the detail differs by law and by where the requester is.
Do we have to offer a DSAR form?
Most privacy laws don't require a specific form; an email address is often enough. A form on your trust center means requests arrive in a consistent shape and with a record, rather than as one-off emails that are easy to lose track of.
What request types does the form cover?
Access, deletion, correction, export and other, so someone with a request that doesn't fit the first four can still describe it.
Who has to comply with GDPR or CCPA requests?
It depends on factors like where your business operates, where your customers are, and how much personal data you process. Check your own obligations rather than assuming a law does or doesn't apply.
Where do requests go?
To the privacy contact you set in the admin, by email, and into the admin's list of privacy requests. Replying to the email replies to the requester.
Can I link to the form from my privacy policy?
Yes. The form opens from a link of its own, such as trust.yourcompany.com/#privacy-request, so you can put it in your privacy policy, your cookie notice or an email footer. You can switch the form off in the admin if you no longer want it shown.
Related reading
Give people a place to send a privacy request.
From £39 a month. No sales call.