GDPR data subject request form template

03 / Make it yours

Choose your stack. Copy your form.

Replace the example endpoint with your Formward endpoint, then adapt the fields to your needs.

<form action="https://forms.formward.eu/f/your-form-id" method="POST">
  <label for="name">Full name</label>
  <input type="text" name="name" id="name" required />
  <label for="email">Email you use with us</label>
  <small id="email-help">We reply to this address and use it to find your data.</small>
  <input type="email" name="email" id="email" aria-describedby="email-help" required />
  <label for="request_type">What would you like us to do?</label>
  <select name="request_type" id="request_type" required>
    <option value="Give me a copy of my data">Give me a copy of my data</option>
    <option value="Correct my data">Correct my data</option>
    <option value="Delete my data">Delete my data</option>
    <option value="Send my data to me in a reusable format">Send my data to me in a reusable format</option>
    <option value="Stop or limit how you use my data">Stop or limit how you use my data</option>
    <option value="Withdraw my consent">Withdraw my consent</option>
  </select>
  <label for="details">Details</label>
  <small id="details-help">Which data or which part of our service this is about, if you know.</small>
  <textarea name="details" id="details" aria-describedby="details-help"></textarea>
  <input type="text" name="_gotcha" tabindex="-1" autocomplete="off" style="position:absolute;left:-9999px" aria-hidden="true" />
  <button type="submit">Send</button>
</form>

Accessibility

Accessible by default, and how to keep it that way

• Every field in the code has a visible label tied to it with for and id, so screen readers announce what to enter and a click on the label focuses the field.
• Required fields carry the required attribute, so the browser explains a missing answer before anything is sent. Say “required” in words as well; an asterisk or a colour alone is easy to miss.
• The spam trap field (_gotcha) is hidden from screen readers with aria-hidden and skipped by the Tab key, so people never meet it.
• In the JavaScript versions, show the confirmation or error in an element with role="status" so the result is announced, and keep the entered answers when sending fails.

Changed the fields? Paste your version into the HTML form tester to see exactly what it sends, or run it through the GDPR form checker.

04 / Implementation

How the code talks to Formward

Next.js client component

Copy"use client";

import { useState } from "react";

export function DataSubjectRequestForm() {
  const [sent, setSent] = useState(false);

  async function onSubmit(e: React.FormEvent<HTMLFormElement>) {
    e.preventDefault();
    const form = e.currentTarget;
    const res = await fetch("https://forms.formward.eu/f/your-form-id", {
      method: "POST",
      headers: { Accept: "application/json" },
      body: new FormData(form),
    });
    if (res.ok) {
      setSent(true);
      form.reset();
    }
  }

  if (sent) return <p>Thanks! Your message has been sent.</p>;

  return (
    <form onSubmit={onSubmit}>
      <label htmlFor="name">Full name</label>
      <input type="text" name="name" id="name" required />
      <label htmlFor="email">Email you use with us</label>
      <small id="email-help">We reply to this address and use it to find your data.</small>
      <input type="email" name="email" id="email" aria-describedby="email-help" required />
      <label htmlFor="request_type">What would you like us to do?</label>
      <select name="request_type" id="request_type" required>
        <option value="Give me a copy of my data">Give me a copy of my data</option>
        <option value="Correct my data">Correct my data</option>
        <option value="Delete my data">Delete my data</option>
        <option value="Send my data to me in a reusable format">Send my data to me in a reusable format</option>
        <option value="Stop or limit how you use my data">Stop or limit how you use my data</option>
        <option value="Withdraw my consent">Withdraw my consent</option>
      </select>
      <label htmlFor="details">Details</label>
      <small id="details-help">Which data or which part of our service this is about, if you know.</small>
      <textarea name="details" id="details" aria-describedby="details-help" />
      <input
        type="text"
        name="_gotcha"
        tabIndex={-1}
        autoComplete="off"
        style={{ position: "absolute", left: "-9999px" }}
        aria-hidden="true"
      />
      <button type="submit">Send</button>
    </form>
  );
}

Questions

Do I need a form for GDPR requests?

No. A request made by email, by letter or in any other way is just as valid. A form helps people include what you need and helps you track the deadline, so offer it next to your privacy email address, not instead of it.

Can I ask for ID before answering?

Only when you have reasonable doubts about who is asking. Matching the request to the email address you already hold is often enough, and asking everyone for a passport copy collects more data than the request needs.

Related

• Handling data subject requests

  What each right means for form data, and how to answer.

• Privacy notice for a form

  Where to link this form from.

• GDPR form checker

  Check the finished form for insecure settings and trackers.

• Support request template

  For questions that are not about personal data.