# DSAR Form Builder & Privacy Request Management (DSAR 3.0) > Build custom DSAR forms with conditional fields, identity verification and deadline tracking. See what's new in Secure Privacy DSAR 3.0 and how to set it up. - Canonical: https://support.secureprivacy.ai/article/dsar-3-0-dsar-form-builder-privacy-requests - Product: Consent Management - Category: DSARs - Published: 2026-09-30T21:40:00+00:00 - Updated: 2026-09-30T21:45:11.896+00:00 - Reading time: 19 minutes --- A customer asks what personal data you hold about them. Another wants their account deleted. A third writes in on behalf of a family member. Each one is a **data subject access request (DSAR)**, and the clock starts the moment it arrives: generally one month under GDPR and 45 days under the CCPA. When those requests come in through a generic contact form or a shared inbox, deadlines slip, identity checks go undocumented, and pulling together records for an audit turns into a copy-paste exercise. Most teams patch the problem with what they already have: one-size-fits-all contact forms that ask every visitor the same questions, spreadsheets for tracking response deadlines, and email threads as the only audit trail. Standalone DSAR tools help, but they usually mean another vendor to manage and another page your visitors have to find. **DSAR 3.0** brings privacy request management into the same Secure Privacy platform that runs your cookie consent banner. A visual **DSAR form builder** lets you define your own request types, ask who is submitting, and show each visitor only the fields that apply to their request. Every submission lands in one **Privacy Requests** dashboard with a statutory deadline countdown, identity verification status, downloadable attachments and a filtered CSV export for audits. DSAR handling, without the inbox chaos. By the end of this guide, you will know what changed in DSAR 3.0, how to build and publish a DSAR form on your website, in your mobile apps or on a dedicated privacy request page, and how to review, verify and export the requests that come in. ## Who this DSAR guide is for - Privacy, legal and compliance teams who need a documented, deadline-aware intake process for GDPR, CCPA and other privacy law requests. - Data Protection Officers who want to capture the right details up front, such as who is submitting, what they are asking for and any supporting documents. - Website and app administrators who already publish the Secure Privacy consent banner and want the data request form in the same place. - Existing Secure Privacy customers moving from the previous fixed-layout DSAR forms to the new form builder. ## Prerequisites - A Secure Privacy account with access to **Privacy Requests**. - The Secure Privacy tag installed on every domain where the Data Request tab should appear. - Mobile SDK support on your account, if you want to offer the form in mobile or TV apps. - Optional: Secure Privacy Governance, if you want to route incoming requests to the Governance portal. ## What's new in DSAR 3.0 This update introduces a redesigned DSAR (Data Subject Access Request) experience: a visual form builder, flexible request and identity types, conditional fields, and a clearer admin view of incoming submissions. Previously, DSAR forms relied on a fixed set of request types and a relatively static field layout. DSAR 3.0 moves to a configurable form model: you define request types and (optionally) identity types, add custom fields, and control which fields appear depending on what the visitor selects.
DSAR 3.0 at a glance

Area

What changed

Form design

Visual form builder with request types, optional identity types, custom fields and conditional visibility

Request types

Fully configurable; no longer tied to a fixed list for new forms

Identity

Optional identity selection step; identity type stored and shown on submissions

Conditional fields

"Shown for" controls visibility; "Required" applies when a field is visible

Public forms

Preference Center Data Request tab and dedicated DSAR page; both send type selections

Admin

Privacy Requests with dynamic filters, a richer detail panel, statutory deadlines, attachments and CSV export

Validation

Server validates required fields while respecting conditional visibility

Web form embed

Coming soon

This release is aimed at teams that need flexible DSAR forms (multiple request and identity paths, conditional questions, attachments) and a clearer compliance workflow for reviewing and acting on incoming privacy requests. Below is a walkthrough of each new capability and how they fit together. ## Manage incoming DSARs in the Privacy Requests dashboard Submissions are stored with richer metadata and are available at the top level under **Privacy Requests**. The page lists submissions from all of your DSAR forms, with: - **Dynamic request type filter:** options come from each form's configured request types (English labels), not a fixed global list. - **Detail panel** with header badges for request type, identity type (when present), source domain and form name. - **Submitted details:** the visitor's field answers, with attachments available for download when present. - **Identity verified indicator:** shown only when verification was actually completed. - **Statutory deadline:** a countdown based on the visitor's country and the applicable regulation. ![Secure Privacy Privacy Requests dashboard listing DSAR submissions with filters for form, request type and status, and the Export CSV button](image-20260820-160539.png) The Privacy Requests dashboard lists DSAR submissions from every form in one place. ### View DSAR details and track the statutory deadline Click any row to open the submission detail panel. Alongside the submitted details and the deadline countdown, the panel includes **Mark as done** and **Delete** actions, so you can close out a request once it has been handled. ![DSAR submission detail panel showing request type, identity type, source domain, submitted details and a GDPR 30-day statutory deadline countdown](image-20260820-160910.png) The detail panel shows who submitted, what they asked for and how many days remain before the statutory deadline. ### Export privacy requests to CSV for audits and reporting The **Export CSV** action lets you pull submission data out of the platform for reporting, audits or offline review. The export respects whatever you currently have filtered in the grid (DSAR form, search by email or request ID, request type and status), so you export exactly the slice you are looking at rather than the entire account. Before the export runs, a confirmation step summarizes those filters so you can double-check the scope. The export is processed in the background, and you receive an email with a download link when the file (a zipped CSV) is ready. Each row includes the submission ID, form name, request type, status, contact email (when present), source, location data, date created, and all submitted field values in a single column. Only one export can run at a time per account, and daily export limits apply on paid plans. This replaces manual copy-paste from the detail panel when you need bulk DSAR records for compliance workflows. ![Export privacy requests confirmation dialog summarizing the selected form, request type and status filters before the CSV export runs](image-20260820-155118.png) A confirmation step summarizes your filters before the CSV export starts. ## Publish your DSAR form in the Preference Center (Embed settings) The **Preference Center** tab under **Embed** is where you connect a DSAR form to your live, visitor-facing channels. Start by choosing which form to publish from the dropdown at the top. The main switch, **Enable Data request tab**, controls whether that form is active in the Preference Center at all. When it is off, the form is unassigned from every domain and app until you turn it back on. With publishing enabled, assign the form to one or more **domains** where the Secure Privacy tag is already installed. Visitors on those sites will see a **Data Request** tab inside the consent and privacy banner and can submit using the configuration from Form Builder. If your account includes mobile SDK support, you can also link the same form to **mobile apps** and **TV apps**, so in-app preference centers offer the same request flow. The **Open DSAR in a separate page** option adds a dedicated privacy request URL, which is useful when you want a full-page wizard rather than the inline tab. This screen controls _where_ and _how_ the form is offered, not the fields or request types themselves, which remain in Form Builder. Click **Save** when you are done to apply your assignments. ![Embed settings Preference Center tab with the Enable Data request tab switch, assigned domains and linked mobile apps for a DSAR form](image-20260820-161927.png) Assign a DSAR form to your domains and apps from Embed, then Preference Center. ## Account-wide DSAR settings: email verification, spam protection and Governance routing The **Settings** tab under Privacy Requests controls behavior for your entire account, not individual forms: - **Require email verification** turns on the magic-link flow: visitors must confirm their email before a request is fully accepted, which helps reduce bogus or mistaken submissions. - **Spam protection** enables a captcha on public DSAR forms to limit automated abuse. - **Route privacy requests to Governance** (when you use Secure Privacy Governance) syncs incoming requests into the [Governance portal's DSAR handling module](https://support.secureprivacy.ai/article/how-to-handle-dsars-governance-platform), so you can manage SLAs, ownership, fulfilment and audit trails in one place. These switches apply globally and every form inherits them, so you set verification, security and routing once rather than per form. Form-specific choices, such as which user receives notifications, supported languages and the form name, live in the Form Builder editor instead. Save your changes from the action bar when you are done. ![Privacy Requests Settings with toggles for Require email verification, captcha spam protection and Route privacy requests to Governance portal](image-20260820-161048.png) Verification, spam protection and Governance routing apply to every DSAR form in your account. ## Build a custom DSAR form with the Form Builder The **Form Builder** tab is where you view, configure and add DSAR forms. Open a specific form by clicking its row or through the row's context menu, or click **Add DSAR** to create a new one. ![Form Builder list of DSAR forms showing recipient, submission count, pending requests and status toggles, with the Add DSAR button](image-20260820-162141.png) Form Builder shows every DSAR form with its recipient, submissions and status. Each form can be published to two targets: - **Preference Center:** the Data Request tab inside the consent and privacy banner on your website or mobile/TV application. - **Dedicated DSAR page:** a standalone page linked from your DSAR settings. Both targets share the same form configuration, while the dedicated DSAR page offers the more advanced, step-by-step experience. The form editor is interactive: click any label or title to change its text for the selected language. ![DSAR form editor with supported languages, notification recipient and an editable form title above the Who are you identity selection](image-20260820-162724.png) Click any label or title in the form editor to edit it for the selected language. ### Identity selection: ask who is submitting the request (optional) You can turn on **identity selection**, a step where the visitor indicates _who_ is submitting, for example "I am the data subject" or "I am submitting on behalf of someone else". This is useful when requests can come from different groups, such as customers, employees or authorized agents acting for another person. Identity types use the same pattern as request types: icon, color, labels per language, and enable/order controls. When enabled, identity selection appears as its own section in the form flow. The icon is optional and can be changed from the icon library or unset. ![Identity type settings in the DSAR form builder with an icon library and color picker for a custom identity type](image-20260820-163013.png) Give each identity type its own icon, color and per-language label. ### Custom DSAR request types Request types are no longer limited to a predefined list. You configure **tiles** (or options in the Preference Center dropdown) with: - Labels per language - An icon and color - Enable/disable and reordering with drag and drop ![Configurable DSAR request type tiles for Access, Deletion, Correction, Export, Objection and Opt out being reordered with drag and drop](image-20260820-162548.png) Reorder request types with drag and drop. Visitors pick a request type before, or while, filling in their details. The chosen type is stored on the submission as an **English label**, which is used for filtering and display in Privacy Requests. You can add custom request types beyond the usual Access, Deletion, Correction, Export, Objection and Opt out, or delete the ones your privacy operations do not need. ![Custom DSAR request type without an icon added alongside the Access, Objection and Opt out request types](image-20260820-163302.png) Add your own request types, with or without an icon. ### Custom fields and supported field types Supported field types include text, email, textarea, select (dropdown), radio buttons, checkboxes, country picker, advanced phone picker, date picker and file attachment. For each field you can: - Drag to reorder it - Set labels per language - Mark it as **required** (a simple on/off switch) - Control **when the field is shown** using conditional visibility ### Conditional visibility: show fields only for specific request types ("Shown for") Each field can be shown **for all** request and identity combinations, or **only for specific** request types and/or identity types: - If no restriction is set, the field is visible to everyone who reaches that part of the form. - If targets are set, the field appears only when the visitor's selected request type and/or identity type matches. ![Conditional visibility settings on a DSAR form field with the Required toggle and Shown for selection of request types and identity types](image-20260820-163504.png) Use "Shown for" to display a field only for the request or identity types that need it. **Required** works separately: when a field is visible and marked required, it must be filled in before the visitor can submit. There is no separate "required only for X" rule. Visibility and requiredness work together: hidden fields are not validated, and visible required fields are. This matches how submissions are validated on the server. ### Branding, languages and notification recipient - **Logo:** upload it in the form builder toolbar; it is shown on the public form. - **Languages:** form content is edited per configured DSAR language, with English noted as the default where applicable. - **Recipient:** choose which Secure Privacy user receives submission notifications (same as before, now integrated into the builder flow). Section headings, such as "Request type", "Who is submitting?" and "Your details", are also editable per language. ![DSAR form editor with English and French as supported languages, a notification recipient and a custom logo on the form](image-20260820-164052.png) Set supported languages, the notification recipient and your logo in the form editor. ## Where visitors submit a DSAR ### Data Request tab in the Preference Center (website banner) When a DSAR form is linked to a domain's banner, visitors open the Privacy / Preference Center and use the **Data Request** tab. The compiled layout includes: - Request type (and identity type, if enabled) selectors - Your custom fields, with conditional show/hide - The submit flow, including optional email verification ![Data Request tab in the Secure Privacy preference center banner with identity, request type and name fields and a Submit button](image-20260820-170019.png) Visitors submit privacy requests from the Data Request tab, right next to their cookie settings. ### Dedicated DSAR page with a step-by-step wizard The standalone DSAR page uses a **wizard-style** flow when identity selection and/or multiple request types are configured: choose identity → choose request type → fill in fields → review and submit. The same configuration drives which fields appear at each step. ![Dedicated DSAR page wizard at step 1 of 4, asking the visitor to choose an identity type](image-20260820-164855.png) Step 1 of the dedicated DSAR page: the visitor chooses who is submitting. ![Review your request step of the dedicated DSAR page summarizing identity, request type and contact details before submission](image-20260820-165013.png) Visitors review their request before submitting. ![DSAR request submitted confirmation listing next steps: verify your email, request processed within 30 days, confirmation once complete](image-20260820-165031.png) After submitting, visitors see what happens next. ### Web form embed (coming soon) The **Web form** embed option in DSAR settings is not active in this release. The Preference Center and the dedicated DSAR page are the supported public surfaces for now. ## How DSAR submissions are stored, validated and verified ### What each submission stores
Data stored with each DSAR submission

Field

Meaning

Request type

English label of the selected request type

Identity type

English label of the selected identity type (if identity selection was enabled and the visitor chose one)

Controls

Answers to custom fields (keyed by field label)

Source

Where the form was submitted (domain, app or URL context)

Status

Including the unverified → verified flow when email verification is on

### Server-side validation of required fields On submit, the backend checks that all visible, required fields have values, using the same conditional rules as the public forms (selected request type plus identity type). Submissions missing required visible fields are rejected with a clear message listing the missing field labels. ### File attachments on DSAR forms DSAR forms support file attachment fields (PDF and images; size limits apply). Files upload separately before submit, and the original file name is preserved. Admins can download attachments from the submission detail panel on the Privacy Requests page. ![File upload field on the dedicated DSAR page wizard with an attached image as supporting evidence](image-20260820-165339.png) Visitors can attach PDFs or images to their request. ![Privacy Requests detail panel showing a downloadable file attachment on a DSAR submission](image-20260820-165632.png) Attachments are downloadable from the submission detail panel. ### Email verification for DSAR submissions When email verification is enabled, the visitor receives a verification email after submitting. The submission stays in an unverified state until they confirm. **Important:** The Privacy Requests admin panel does not show unverified submissions. A request appears there only after the visitor confirms their email address. ![Verification email asking the requester to confirm their email address for a data subject access request](image-20260820-165140.png) The verification email visitors receive after submitting a DSAR. ## How to set up a DSAR form in Secure Privacy: recommended workflow Follow these seven steps to build, publish and monitor a DSAR form with DSAR 3.0. ### Step 1 - Create or open a DSAR form In Privacy Requests, go to Form Builder. Click Add DSAR to create a new form, or click an existing row (or use its context menu) to open it in the form editor. ### Step 2 - Configure request types and identity types Add, remove and reorder the request types your organization handles. If you need to know who is submitting, turn on identity selection and configure your identity types. ### Step 3 - Add fields and set conditional rules Add and order your fields, then set Required and Shown for where needed, so each visitor sees only the questions that apply to their request. ### Step 4 - Set languages, logo and recipient Choose the supported languages, upload your logo, and select the Secure Privacy user who receives submission notifications. ### Step 5 - Preview the Preference Center experience Use Preview to check how the form looks and behaves inside the Preference Center before you publish it. ### Step 6 - Publish the form to your domains or dedicated page In Embed, then Preference Center, turn on Enable Data request tab and assign the form to your domains (and apps, if available). Use the dedicated page link as needed, then click Save. ### Step 7 - Monitor submissions in Privacy Requests Review incoming requests, track each statutory deadline, and export records to CSV when you need them for audits. ## What happens after your DSAR form is live Once your form is published, the day-to-day workflow runs from **Privacy Requests**: - Verified submissions appear in the list, filterable by form, request type and status. If email verification is on, a request appears only after the visitor confirms their email. - The detail panel shows the **statutory deadline** countdown, so you can prioritize the requests closest to their legal response date. - When a request has been handled, use **Mark as done** to close it. - Use **Export CSV** to keep records for audits and accountability reporting, or route requests to Secure Privacy Governance to manage SLAs, owners and audit trails there. For guidance on preparing the response itself, see [how to handle a DSAR under GDPR Article 15](https://support.secureprivacy.ai/article/gdpr-article-15-dsar-compliance-process/). ## Troubleshooting DSAR forms and privacy requests ### A submitted DSAR does not appear in Privacy Requests If Require email verification is on, unverified submissions are hidden until the visitor confirms their email. Ask the visitor to check their inbox (and spam folder) for the verification email. ### The Data Request tab is not showing on my website In Embed, then Preference Center, check that Enable Data request tab is on, that the form is assigned to the correct domain, and that you clicked Save. The Secure Privacy tag must also be installed on that domain. ### A field is missing from the form Check the field's Shown for setting. If it is restricted to specific request types or identity types, it only appears when the visitor selects a matching option. ### Visitors see an error about missing required fields The server rejects submissions where a visible, required field is empty, and the error lists the missing field labels. Review which fields are marked Required and confirm the conditional rules match the request types that need them. ### My CSV export has not arrived Exports run in the background and arrive by email as a download link to a zipped CSV. Only one export can run at a time per account, and daily limits apply on paid plans. Also check your grid filters, since the export includes only the filtered results. ### The Identity verified indicator is missing on a request The indicator is shown only when verification was actually completed for that submission. ### The Web form option in Embed does not work The Web form embed is not active in this release. Use the Preference Center Data Request tab or the dedicated DSAR page instead. Still stuck? [Submit a ticket to Secure Privacy support](https://secureprivacy.atlassian.net/servicedesk/customer/portals). ## Frequently asked questions about DSAR forms and privacy requests ### What is a DSAR (data subject access request)? A DSAR is a request from an individual to exercise their rights over the personal data an organization holds about them. Depending on the law, that can include access to their data, deletion, correction, a portable export, objection to processing, or opting out of the sale or sharing of their data. GDPR, the CCPA/CPRA, LGPD and many other privacy laws give people these rights. ### How long do I have to respond to a DSAR under GDPR and CCPA? Under GDPR you generally have one month from receipt, which can be extended by two further months for complex or numerous requests if you inform the person within the first month. Under the CCPA, businesses have 45 calendar days, which can be extended once by another 45 days with notice. Secure Privacy shows a statutory deadline countdown on each request, based on the visitor's country and the applicable regulation, so you can see how much time is left at a glance. ### Do I need a DSAR form on my website? Privacy laws require you to give people a practical way to exercise their rights, and a web form is one of the most common methods and one of the easiest to document. Some laws, such as the CCPA, also specify which submission methods you must offer, so check the requirements for each jurisdiction you operate in. With Secure Privacy, the DSAR form sits in the same preference center as your cookie banner, so visitors can find it without searching through your site. ### How do I verify the identity of someone who submits a DSAR? Turn on Require email verification in the Privacy Requests Settings tab. Visitors then receive a magic link and must confirm their email before the request is fully accepted, and the Identity verified indicator appears on the submission only once verification is complete. If you need more evidence for certain request types, add a file attachment field and use Shown for to display it only where it applies. Ask only for the information you genuinely need to confirm identity. ### Can someone submit a DSAR on behalf of another person? Yes. Many privacy laws allow requests through an authorized agent, parent or guardian. Enable identity selection in Form Builder and add an identity type such as "I am submitting on behalf of someone else". You can then use conditional visibility to show extra fields, like a proof-of-authorization upload, only to people who choose that option. The selected identity type is stored on the submission and shown in Privacy Requests. ### Can I create custom DSAR request types in Secure Privacy? Yes. In DSAR 3.0, request types are fully configurable. Add your own types alongside Access, Deletion, Correction, Export, Objection and Opt out, give each one labels per language, an icon and a color, reorder them with drag and drop, or remove the ones you do not need. ### How do I export DSAR records for an audit? In Privacy Requests, filter the list by form, request type, status or search term, then click Export CSV. Confirm the filter summary, and you will receive an email with a download link to a zipped CSV once the export is ready. Each row includes the submission ID, form name, request type, status, contact email, source, location data, date created and all submitted field values. ### Can I add a DSAR form to my mobile app? Yes, if your account includes mobile SDK support. In Embed, then Preference Center, link the form to your mobile apps and TV apps so in-app preference centers offer the same request flow as your website. ### What is the difference between the Preference Center Data Request tab and the dedicated DSAR page? Both use the same form configuration. The Data Request tab lives inside your consent and privacy banner, so visitors can submit without leaving the page they are on. The dedicated DSAR page is a standalone URL with a step-by-step wizard (identity, request type, details, review), which works well as a link from your privacy policy. ### Can I embed the DSAR form directly on my own web page? Not yet. The Web form embed option is not active in this release. For now, use the Data Request tab in the Preference Center or link to the dedicated DSAR page. ## Related articles - [Managing data subject access requests (DSARs) in Secure Privacy](https://support.secureprivacy.ai/article/managing-data-subject-access-requests-dsars-in-secure-privacy) - [DSAR handling module: deadline tracking and audit logging in Secure Privacy Governance](https://support.secureprivacy.ai/article/how-to-handle-dsars-governance-platform) - [DSAR module in the Secure Privacy Governance Solution](https://support.secureprivacy.ai/article/governance-solution-core-module---dsars) - [How to handle a DSAR under GDPR Article 15](https://support.secureprivacy.ai/article/gdpr-article-15-dsar-compliance-process/) - [GDPR data subject rights and DSAR handling with your DPO](https://support.secureprivacy.ai/article/managing-dsar-through-your-dpo/) - [Custom controls for the previous DSAR form version](https://support.secureprivacy.ai/article/customizing-the-data-request-form-using-dsar-custom-controls-in-secure-privacy) - [All DSAR guides in the Secure Privacy Help Center](https://support.secureprivacy.ai/category/dsars) - [Secure Privacy changelog and release history](https://changelog.secureprivacy.ai) ## Cookie consent and DSARs, managed in one place Secure Privacy is a Google Gold CMP Partner covering 65+ privacy laws, with consent management, DSAR forms and privacy governance in a single platform. [Start your free Secure Privacy trial](https://secureprivacy.ai) (30-day free trial, no credit card required) or schedule a demo with the team.