| name | dsar-form |
| title | DSAR Form |
| description | Drafts a GDPR- and CCPA-compliant Data Subject Access Request (DSAR) intake form for collecting requester information and processing privacy rights. Use when drafting DSAR forms, privacy rights request templates, or data subject rights workflows for EU/US-regulated organizations. |
| author | CaseMark |
| author_url | https://github.com/CaseMark/skills/tree/main/skills/legal/dsar-form |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | cross-jurisdiction |
| practice | data-protection |
| language | en |
| tags | ["drafting","regulatory"] |
DSAR Form
Drafts a legally compliant DSAR intake form enabling individuals to exercise privacy rights under GDPR (Arts. 15–22) and CCPA (Cal. Civ. Code § 1798.100 et seq.).
Prerequisites
Gather before drafting:
- Jurisdiction scope — GDPR, CCPA, both, or additional (UK GDPR, CPRA, VCDPA, CPA)
- Organization identity — legal name, DPO/Privacy Officer contact, submission channels
- Supervisory authority — relevant regulator (ICO, lead SA, state AG)
- Submission infrastructure — secure email, upload portal, or postal address
- Fee policy — whether org charges for manifestly unfounded/excessive requests
Quick Start
Draft the form in six sections in this order: Introduction, Requester Info, Request Details, Identity Verification, Declaration, Submission Instructions.
Form Sections
1 — Introduction & Purpose
State in plain language:
- Legal basis: GDPR Arts. 15–22; CCPA § 1798.100 et seq.
- Rights covered (list request types from Section 3)
- Response timelines (see Response Deadlines)
- Fee conditions for excessive/manifestly unfounded requests
- Right to complain to supervisory authority
2 — Requester Information
| Field | Req | Notes |
|---|
| Full legal name | Yes | As on ID |
| Email address | Yes | Primary contact |
| Phone number | No | Optional |
| Postal address | Yes | Written response option |
| Date of birth | Yes | Identity verification |
| Account/customer ID | No | If applicable |
| Relationship to org | Yes | Customer / Employee / Former employee / Visitor / Representative |
| Alternative names used | No | If interacted under different name |
For authorized representatives: require proof of authority (power of attorney, parental responsibility docs, or equivalent).
3 — Request Details
Request type (checkbox, select all that apply):
- Access — all personal data held
