Is this legal advice or a guarantee of compliance?

No. It is a practical way to receive requests. How you must respond depends on the law that applies to you, and a professional can tell you more.

Is the identity document stored securely?

Uploaded files are stored encrypted. Delete the response when you no longer need it, as holding copies of ID longer than necessary is itself a risk.

Does the form carry out the request?

No. You find, correct or delete the data yourself and reply to the person.

Legal & administration

Data subject access request form (GDPR)

People have rights over their personal data, and you need a reliable way to receive their requests. This form asks for their name and email, what they are requesting (a copy of their data, correction, deletion, restriction or objection), details to help you find the data, proof of identity and a signature.

Use this template All templates

Who it is for

Small businesses, clubs and associations that hold personal data
Freelancers and agencies with client or subscriber lists
Anyone who wants to handle requests in an orderly, documented way

When to use it

Link it from your privacy policy. Asking for proof of identity protects the data of the person concerned, because you do not want to hand someone's information to an impostor. Under the GDPR you generally have to answer within about a month, so noting the date you received each request is useful.

What the form asks

Questions

Full name · requiredShort text
Email address · requiredEmail
What are you asking for? · requiredCheckboxes
Details to help us find your dataLong text
Proof of identity (PDF, PNG or JPEG) · requiredFile upload
Signature · requiredSignature

Every question can be changed, removed or reordered before you publish.

The PDF your respondents receive

Each request becomes a dated PDF with the details and the type of request, and the identity document is stored with the response. It documents when the request arrived, which helps you show that you answered in time.

First page of the sample PDF made by the Data subject access request template, filled with invented data — A sample of the PDF this template produces, filled with invented data. Your logo, colours and wording replace the sample ones.

Questions people ask

Is this legal advice or a guarantee of compliance?: No. It is a practical way to receive requests. How you must respond depends on the law that applies to you, and a professional can tell you more.
Is the identity document stored securely?: Uploaded files are stored encrypted. Delete the response when you no longer need it, as holding copies of ID longer than necessary is itself a risk.
Does the form carry out the request?: No. You find, correct or delete the data yourself and reply to the person.

Start from this template

Create an account, adapt the questions and the document to your business, then share the link. Your respondents get their PDF the moment they finish.

Use this template