The deadline runs from receipt, not from reading
One month or a shorter deadline per form type, with early warning and overrun as notifications. An extension of up to two months needs a reason in the request, just as Art. 12(3) demands.
Data Protection & GDPR
Public forms for data subject rights
The entry point Art. 12 GDPR requires, instead of an e-mail address in the privacy notice
Art. 12(2) GDPR requires the controller to facilitate the exercise of data subject rights, and paragraph 3 sets the response deadline at one month from receipt. The module turns that into an address that belongs in the privacy notice, on the website or as a QR code on a form. Every submission immediately becomes a data subject request with case number, running deadline and owner; the default handlers are notified, and the applicant receives an access code for the status page and follow-up questions. The form deliberately accepts no files: an anonymous endpoint with upload would be an open door. Evidence is requested via the return channel.
DSGVO Art. 12DSGVO Art. 15 bis 22
Features
Your benefits
Identity check as a state, not a gut feeling
Where there are reasonable doubts, Art. 12(6) allows additional information. The switch "identity check required" starts the request in that state; evidence is requested via the return channel, never through the open form.
No file, no captcha, no door
Name and e-mail are always requested, everything else is configurable. The form accepts no files, because there is neither virus scanning nor captcha and an anonymous upload endpoint would be exactly the attack surface a privacy form should not open.
Capabilities
All capabilities at a glance
- Form types per right or combined, language, further rights selectable
- Fields: applicant type, phone, address, message, extra fields such as customer number
- Stable public address, QR code, embedding in your own website, reserved address when withdrawn
- Data subject request with case number, owner, deadline, early warning, extension with reason
- Notification of default handlers, confirmation e-mail, task and deadline command
- Access code for the applicant’s status page and follow-ups, messages on the case
- Linked privacy notice under Art. 13 below the form, optionally with a checkbox
- Off by default, because a public entry point is set up deliberately
Result
A data subject finds the way, the deadline runs by itself, and the evidence that you facilitate the exercise of rights is the address itself.
Experience Public forms for data subject rights live
Schedule a no-obligation demo – we will show you the module with your own use cases.