Handle privacy requests before the deadline does.
Privacyboard gives your customers a request form, adds each request to your workspace with its legal deadline already counted, and prepares the replies for you: receipt, identity check, extension, refusal and completion.
Free to set up · No credit card · About 5 minutes
In short
- Deadline
- One month from receipt, counted for you
- Requests
- Access, rectification, erasure, restriction, portability, objection
- Replies
- Written for each situation and logged on the request
- Alerts
- Overdue and due-soon requests show on your overview
A request form your customers can find
Customers send a request from your privacy center. They get a reference number and an automatic receipt.
The deadline is counted for you
Each request shows the days left and the date to reply by. Requests running late appear on your overview.
Replies written for each situation
Pick receipt, identity check, extension, refusal or completion. The message is prepared and logged on the request.
What is a data subject request?
A data subject request, often called a DSAR when it asks for access, is a person using one of their GDPR rights: to see their data, correct it, have it erased, restrict or object to its use, or receive it in a portable format. The company must answer without undue delay and at the latest within one month.
The hard part is rarely the law. It is not losing a request in an inbox, knowing the date by which to reply, and answering consistently. Privacyboard turns that into a tracked list with a visible deadline.
How it works
- 1
A visitor sends a request
Your privacy center has a request form. The person receives an automatic receipt with a reference number.
- 2
It appears in your workspace
The request is added on its own with its type, the date received and the reply-by date.
- 3
Reply and close
Pick the reply that fits: identity check, extension, refusal or completion. It is logged on the request.
What you get
A public request form
Anyone can send a request from your privacy center, and every request gets a reference number.
The deadline, counted
The one-month period runs from receipt, or from the identity check when you asked for one. An extension is recorded with its reason.
Replies for every situation
Receipt, identity check, extension, refusal and completion are written for you, and you can edit the wording.
What to check, per right
For each type of request, a short guide lists what to look for and what a complete answer contains.
Alerts that matter
Requests past the deadline or due within seven days appear at the top of your overview and in the menu.
A record you can show
Each request keeps its dates, status and sent replies, so you can show how it was handled.
What the GDPR says about these requests
This is a summary, not legal advice. Complex or contested requests may need a professional.
- Articles 15 to 22
- The rights of access, rectification, erasure, restriction, data portability, objection and not being subject to solely automated decisions.
- Article 12(3)
- You must respond without undue delay and within one month of receipt. If the request is complex or you receive many, you can extend by two further months, and you must tell the person within the first month, with the reasons.
- Article 12(6)
- If you have reasonable doubts about who is asking, you can request additional information to confirm identity.
- Article 12(5)
- Information and actions are free of charge, unless requests are manifestly unfounded or excessive.
Questions, answered.
How long do I have to answer a GDPR request?
One month from receiving it. For complex requests or a large number of them you can extend by up to two further months, as long as you tell the person within the first month and explain why.
What counts as a data subject access request?
A person asking what personal data you hold about them and how you use it. Other rights, such as erasure or objection, are separate requests with the same one-month deadline.
Does the deadline start when I verify identity?
If you have reasonable doubts about identity and ask for more information, Privacyboard counts the period from the moment you confirm the identity. The request is shown as waiting until then.
Can people send requests without an account?
Yes. The form in your published privacy center is open to anyone and does not require them to sign up.
Do I get notified of a new request?
Yes. New requests are added to your workspace and flagged in the menu and on your overview. Email notifications use the email setup of your workspace.
Is the tracker free?
Yes. Tracking requests is part of the free workspace. Receiving them from the public form needs your privacy center to be published, which is part of Pro.