DSAR tools for a firm without a privacy team
For a firm that answers access and deletion requests by hand today, from a shared inbox, with no privacy staff. 7 request tools, from a simple form to full automation, measured against what GDPR Art. 12 and the CCPA ask of a request from the day it arrives: identity checks, the one-month and 45-day clocks, extensions, the record and redaction. Every cell comes from each vendor’s own pages. read 2026-10-22
Best for having the steps done for you
MineOS
Its own help docs cover 8 of the 9 rows, from the receipt confirmation to an exportable log. Confirm which modules your plan includes.
Best for a handful of requests a year
Enzuzo
Requests, a verification step and due-date reminders on its free plan; the audit trail needs a paid one.
Best if its banner already runs on your site
Osano
Requests sit in the same platform as its banner. Its basic subject-rights tier starts at the Basic Privacy plan.
The request duties, tool by tool
Each row is something the law asks you to do with a request, with the article or section it comes from. Read across for one duty; read down for one tool. “paid plan” means the feature exists but not on the vendor’s free or entry tier. If your requests come mostly from California, the CCPA compliance software page measures the wider set of CCPA duties.
| Requirement | Termly | Complianz | Enzuzo | Osano | DataGrail | Ketch | MineOS |
|---|---|---|---|---|---|---|---|
| Takes requests by web form and other channels§ 1798.130(a)(1); GDPR Art. 12(2) | yesevery plan | paid planPremium form | yesform + manual entry | paid planweb, email, API | yesweb form | paid planform, in-app, API | yesform, email, phone |
| Verifies the requester’s identityGDPR Art. 12(6); CCPA regs § 7060 | not stated | not stated | yesworkflow step | paid planmulti-factor | yesSmart Verification | paid planby request type | yesemail check |
| Counts down the response deadlineGDPR Art. 12(3); § 1798.130(a)(2) | not statedemail checklist | not stated | yesdue-date reminders | paid plandue dates | yesdeadline alerts | not statedstatus queue | yesSLA per workflow |
| Records an extension and its noticeGDPR Art. 12(3); § 1798.130(a)(2) | not stated | not stated | not stated | partialconfigurable | not stated | not stated | not stated |
| Confirms receipt to the requesterCCPA regs § 7021(a) | not statednotifies you only | not statedadmin email only | not stated | paid planconfirmation email | not stated | not stated | yesauto acknowledgment |
| Keeps a request log you can hand overCCPA regs § 7101; GDPR Art. 5(2) | not statedemail only | paid planexport not stated | paid planGrowth and up | paid planaudit trail | partialexport not stated | paid planaudit logs | yesCSV export |
| Redacts other people’s data from a copyGDPR Art. 15(4) | not stated | not stated | not stated | not statedFAQ only | not stated | paid planPDFs | yesfile stores |
| Carries a deletion to each systemGDPR Art. 19; CCPA regs § 7022(b) | not stated | not stated | not statedrequest type only | paid planwhere APIs exist | yesintegrations | paid planhistorical data too | yesintegrations |
| Delivers the copy securely, in a usable formatGDPR Art. 15(3); § 1798.130(a)(2)(A) | not stated | not stated | not stated | paid planencrypted link | not stated | not stated | yessecure link |
Source: vendor pages and help docs, read 2026-10-22. “not stated” means the vendor’s own documentation does not say. | |||||||
One request, stop by stop
The table reads across. This reads down: the stops a single access or deletion request passes through, what the law asks at each, and how many of the 7 tools here document doing it for you. A short bar is a stop you will still run by hand. For the dates themselves, the DSAR deadline calculator works out the due date and the extension date from the day a request arrived.
- 01
It arrives
Two or more ways to ask, one of them a toll-free number. A business that operates only online and deals with the consumer directly needs only an email address.
§ 1798.130(a)(1)(A)7 of 7 tools document it
- 02
Say you have it
Within 10 business days, confirm receipt and explain how you will verify and when to expect an answer.
CCPA regs § 7021(a)2 of 7 tools document it
- 03
Check who is asking
Match what they give you to what you already hold before asking for more. GDPR lets you ask for more only when you have reasonable doubts.
regs § 7060(c)(1); GDPR Art. 12(6)5 of 7 tools document it
- 04
Watch the clock
One month under GDPR. 45 calendar days under the CCPA, counted from the day it arrives however long verification takes.
GDPR Art. 12(3); regs § 7021(b)4 of 7 tools document it
- 05
Extend, in writing
Two further months under GDPR; 45 more days, once, under the CCPA. Either way, tell the person inside the first period, with the reason.
GDPR Art. 12(3); § 1798.130(a)(2)(A)0 of 7 tools document it
- 06
Take other people out
The copy must not adversely affect the rights and freedoms of others: a colleague’s name in an email thread, another customer in a spreadsheet.
GDPR Art. 15(4)2 of 7 tools document it
- 07
Send the copy
In a commonly used electronic form when the request came electronically; under the CCPA, in a readily usable format.
GDPR Art. 15(3); § 1798.130(a)(2)(A)2 of 7 tools document it
- 08
Pass deletions on
Tell each recipient of the data (GDPR), and your service providers and contractors (CCPA), that it must go.
GDPR Art. 19; regs § 7022(b)(2)4 of 7 tools document it
- 09
Write it down
Keep each request and your answer for at least 24 months: dates, type, channel, what you did and why you denied it.
CCPA regs § 71015 of 7 tools document it
The extension is the stop the tools leave to you. Under GDPR the person must hear about it inside the first month, with the reasons:
“The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.”
The CCPA asks the same inside the first 45 days. Whatever tool you choose, diary the extension date on the day a request lands, and keep a copy of the notice with the request.
Three kinds of DSAR tool, and what each leaves to you
“DSAR software” covers three different things. The useful question for a firm without privacy staff is not which tool is best but which of the stops above you are prepared to run by hand. If you are not yet sure what a request involves, start with what a DSAR is.
A form that emails you
Gives people a proper place to ask and hands each request to you.
- Still yours
- Verifying, the clock, the search, the reply and the log.
- Fits
- A few requests a year and one person who answers them.
- On this page
- Termly, Complianz
A queue that keeps the clock
Holds every request in one dashboard with a verification step and due-date reminders.
- Still yours
- Finding the data in your systems, redacting it and sending it.
- Fits
- Requests every month, still from a small number of systems.
- On this page
- Enzuzo
Automation that reaches your systems
Connects to the apps that hold the data, gathers or deletes it, and keeps the audit trail.
- Still yours
- Connecting each system, and checking each answer before it goes out.
- Fits
- Data spread over many cloud apps, or volume a person cannot keep up with.
- On this page
- Osano, DataGrail, Ketch, MineOS
A shared inbox and a spreadsheet can meet the record-keeping rule if the sheet has the columns the CCPA regulations list: date of the request, what was asked, how it came in, date of your answer, what you did, and the basis for any denial (§ 7101(b)). Pair it with our DSAR response template for the reply. What a sheet cannot do is find the data: if you do not know which systems hold a person’s records, a data map comes before any request tool.
Each tool in short
What each one is, who it fits, which rows its own pages cover, and what to ask before you sign. Tools that also run records, assessments and consent are compared on our OneTrust alternatives page.
Termly
What it is
A request form you embed on your site or link to as a hosted page, sold with Termly’s policy generators and cookie banner. The form is listed on every plan, the free one included.
Who it fits
A small site that has no request form at all yet and will answer the few that arrive by hand.
What the rule requires and whether it meets it
It covers the intake row: a form that lets people choose the GDPR or CCPA request and emails each submission to you, with a checklist on how to respond. From there the work is yours: verifying, the clock, the reply and the record.
Check with the vendor
The pages we read do not describe identity checks, deadline tracking or a request log. If you rely on it, keep the log yourself from the first request.
Complianz
What it is
A WordPress privacy plugin. Its Premium edition adds a data request form under the contact details in your privacy statement, and a dashboard menu where you handle and answer the requests.
Who it fits
A WordPress site that wants requests to stay on its own server, next to the plugin it may already run for its banner.
What the rule requires and whether it meets it
The form asks for a name and email address and lets the person tick one or more requests. Each submission emails the site’s admin address and lands in the dashboard menu.
Check with the vendor
Verification, deadline reminders and exporting the request list are not described. Ask how you would produce two years of request records from the dashboard.
Enzuzo
What it is
A consent banner, policy generator and request dashboard. Its free plan lists DSAR requests with the workflow; the custom form, reporting and audit trail start at its Growth plan.
Who it fits
A firm with a handful of requests a year that wants a dashboard and a reminder, not a project.
What the rule requires and whether it meets it
Requests arrive from a GDPR or CCPA form template or are added by hand when they come by phone, email or post. Its workflow has a verification step, and each request shows the days left with due-date reminders.
Check with the vendor
Extensions, the receipt confirmation and how the copy is delivered are not described. Gathering and deleting the data in your own systems stays a manual job.
Osano
What it is
A privacy platform whose Subject Rights module sits beside its cookie banner. “Basic Subject Rights” (intake forms and basic workflows) starts at its Basic Privacy plan; the full module is quoted.
Who it fits
A firm already running Osano’s banner that wants requests in the same place.
What the rule requires and whether it meets it
Its feature list covers intake by web, email, banner and API, multi-factor verification, automatic due dates, confirmation emails, an audit trail, automatic deletion where a system has an API, and delivery by an expiring encrypted link.
Check with the vendor
Its FAQ says timelines are configurable but not how an extension is logged. Ask which of these features the basic tier includes before you sign.
DataGrail
What it is
A request manager built around integrations with the apps where customer data lives. Its pages offer a demo and an interactive tour rather than a sign-up.
Who it fits
A firm whose customer data is spread across many cloud apps and whose volume has outgrown a spreadsheet.
What the rule requires and whether it meets it
Branded request forms feed one dashboard. Its Smart Verification checks identity against data you already hold, and the dashboard warns before legal deadlines. Fulfilment runs through its integrations.
Check with the vendor
The pages we read do not describe redaction, how the copy is delivered or exporting the request log. Ask for all three in the demo.
Ketch
What it is
A consent platform with a rights-request module. Its free and Starter plans are consent only; request handling is an add-on on Plus and included on Pro.
Who it fits
A firm already on Ketch’s banner, or one that wants opt-outs and requests in one record.
What the rule requires and whether it meets it
Forms, in-product flows and an API take requests; AuthenticatedID sets the identity check by request type; requests route to the systems that hold the data, including historical records. It keeps timestamped audit logs and can redact PDFs.
Check with the vendor
The page we read shows request status but not a deadline countdown, the receipt confirmation or how the copy is delivered.
MineOS
What it is
A privacy and AI-governance platform with a request module and public help docs for every step. Its pages lead to a demo rather than a sign-up.
Who it fits
A firm that wants the receipt, the clock and the log done for it, and can connect its main systems.
What the rule requires and whether it meets it
Requests come from a form, forwarded email, the API or a toll-free line. Form requests must pass an email check; an acknowledgment rule answers each verified request; each workflow carries its own SLA. A redaction tool cleans copies from file stores, the copy goes out as a secure link, and the request log exports as CSV.
Check with the vendor
Extensions are not described. Confirm which modules your plan includes.
How we compared them
We picked tools a firm without privacy staff could adopt: request forms added to products small sites already use for policies or banners, a request dashboard with a free plan, and platforms whose request modules connect to other systems. Where a vendor publishes help docs we read them as well as its product pages. Whole-program suites built for large privacy teams are on the GDPR compliance software page.
Each row is a requirement the rule itself sets, with the article or section cited beside it. Every cell comes from the vendor’s own public documentation, read on 2026-10-22; we did not run trials, take demos or accept vendor answers that are not published.
“not stated” means the vendor’s documentation does not say either way. It is not a “no”: ask the vendor and get the answer in writing. “paid plan” means the feature exists but not on the free or entry tier. There are no scores, ratings or prices on this page.
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
This page is information, not legal advice. A tool that meets a row does not make a site compliant; how it is set up does.
Questions
Does the 45-day clock wait until I have verified the person?
No. Under § 7021(b) of the CCPA regulations the 45 days begin on the day you receive the request, regardless of the time verification takes; if you cannot verify the person inside that period you may deny the request. Under GDPR the month is counted from receipt of the request too (Art. 12(3)). Start verifying the day the request lands.
Do I need a toll-free number for privacy requests?
Under the CCPA, usually yes: § 1798.130(a)(1)(A) asks for two or more ways to submit requests, including at minimum a toll-free number. A business that operates exclusively online and has a direct relationship with the consumer need only offer an email address, and a business with a website must also let people submit through it. Whether the CCPA reaches you at all is what our which-laws tool answers.
Can I charge for answering a DSAR?
Not as a rule. GDPR makes the answer free of charge (Art. 12(5)); you may charge a reasonable fee or refuse only when a request is manifestly unfounded or excessive, and the burden of showing that is yours. A fee based on administrative costs is allowed for further copies (Art. 15(3)). The CCPA requires the information to be delivered free of charge (§ 1798.130(a)(2)(A)).
How long do I keep the record of a request?
The CCPA regulations say at least 24 months, in a ticket or log that holds the dates, the type of request, how it came in, what you did and the basis for any denial, and that the record is used for nothing else (§ 7101). GDPR sets no fixed period, but Art. 5(2) puts the burden of showing compliance on you, and the record is how you show it.
When someone asks for deletion, do I have to tell my vendors?
Yes, under both. GDPR Art. 19 asks you to tell each recipient of the data, unless that proves impossible or involves disproportionate effort. The CCPA regulations ask you to notify your service providers and contractors, and any third party you sold or shared the data with, unless that proves impossible or involves disproportionate effort (§ 7022(b)(2)–(3)). The deletion row in the table is about tools that do this for you.
Does a DSAR tool make the firm compliant?
No. It runs one duty, the requests, and only as well as it is set up. Your privacy notice, your records and your contracts sit outside it; our privacy management software comparison covers tools that run the whole program, and GDPR vs CCPA sets the two request regimes side by side.