GDPR gives you one month to reply; most US state laws give 45 days — and volume keeps climbing (small sites averaged 61 requests a year by 2024, +215% since 2021). Workflow platforms charge $59–120+ per month, per domain and paywall every language but one. This kit is the whole process in a zip: a self-hosted intake form, the deadline engine, 36 response templates in 6 languages, and the fulfillment playbook. One payment of $69 — no subscription.
Get the kit — $69One zip, 55 files: form, clocks, templates, playbook, tracker. Plain Markdown, HTML and JS you can read in any editor. Nothing phones home.
A static HTML/JS form visitors use to request access, deletion, correction, portability, objection or opt-out. Submissions POST to your webhook or email your inbox — request data never touches the vendor's servers, so you never hand anyone the processor role.
GDPR: one calendar month, extendable by two with timely notice. US states: 45 days, most extendable by 45. The due-date engine (Node, zero dependencies) computes every due date, flags 7/3/1-day warnings and validates your whole tracker in one command.
Six response types — acknowledgment, identity verification, extension notice, fulfillment, deletion confirmation, refusal/exemption — in English, German, Italian, Japanese, Korean and Thai. GDPR's "clear and plain language" duty (Art. 12(1)) in practice means answering in the requester's language.
Six chapters: proportional identity verification (per EDPB Guidelines 01/2022), data mapping, safe redaction technique, delivery, lawful refusals and extensions, and the audit log that shows the work was done.
A 15-column tracker CSV with realistic examples, a Node CLI that flags overdue and due-soon requests (exit code 2 means act today), and a local status board that reads the same file — nothing is uploaded anywhere.
A single-buyer commercial license: run the whole process for your own projects and your clients' sites. No per-domain fees — that's the point.
Every figure below is dated and sourced — check them against the linked pages yourself.
The statutory reply clocks: GDPR Art. 12(3) — one calendar month, extendable by two with notice; most US comprehensive state privacy laws — 45 days.
gdpr-info.eu/art-12-gdpr · iapp.org US State Privacy Legislation Tracker (accessed 2026-09-20)Where the workflow tier starts: Secure Privacy's DSAR features begin at $59 per domain per month; Iubenda's data-subject-rights tool sits only on Ultimate ($99.99+/mo); Osano, Transcend and DataGrail publish no self-serve price at all.
secureprivacy.ai/pricing · iubenda.com/en/pricing · osano.com/pricing · transcend.io/pricing (all accessed 2026-09-20)Requests hitting small sites by 2024 — up from 19.4 in 2021 (+215%). At enterprise scale, 87% of all requests are deletions.
termly.io DSAR statistics · DataGrail 2026 Privacy & AI Trends Report (accessed 2026-09-20)The commonly cited manual cost of handling one request (a Gartner figure quoted in DataGrail's reports). The kit costs less than answering three by hand — once, not monthly.
Gartner, as cited in DataGrail 2024 report (original not public — quoted with attribution)No compliance promises. The kit helps you organize and answer requests on time; whether your processing complies with GDPR or any state law is your organization's responsibility. Every template is labeled "starting point, not legal advice" — in all six languages.
No hosted app — on purpose. A hosted intake would make the vendor a data processor under GDPR Art. 28. The kit runs on your infrastructure instead, so request data never passes through anyone else's servers. (A hosted version may come later, if demand proves it.)
Not a cookie banner. This covers individual rights after you hold data — access, deletion, correction, portability, objection, opt-out — not consent management. Different job, different tool.
Deadlines are dates, not magic. The engine does date arithmetic, and its sources are listed with a check date (September 2026). Laws change — the kit includes a 15-minute quarterly refresh ritual telling you exactly what to re-check.
The kit is built so you edit three things and start working — the process itself is already written.
Set your company name and privacy inbox in config.js, upload the folder to any static host or embed via iframe — WordPress and Webflow recipes are included.
Replace the [COMPANY_NAME]-style placeholders in your language's six templates. They're drafted from the regulation texts — not copied from a vendor's proprietary pack.
The playbook decides each step; the tracker keeps every clock visible. When a request lands you follow the checklist — you don't invent a process under deadline pressure.
No monthly plan, no per-domain fee, no per-seat math — the incumbent pricing model for this category is exactly what you're escaping.
Secure checkout via Stripe · card payments · taxes calculated at checkout · 14-day full money-back guarantee, no questions asked
No — and that's the point. Platforms charge monthly, per domain, and gate the workflow behind sales calls: Osano's Subject Rights module is custom-quote only, Transcend and DataGrail publish no self-serve prices at all (checked 2026-09-20). This kit is the workflow as files you own — pay once, run it on your infrastructure forever.
A 55-file zip: the self-hosted intake form (HTML + JS + one config file), the deadline engine and tracker (Node + CSV + local status board), 36 response templates (6 types × 6 languages), the 6-chapter playbook with dated sources, and the license. Plain files, no build step, no dependencies.
No product can honestly promise that, and you should be skeptical of any that do. The kit helps you respond to rights requests on time with a documented process — that's an operation, not legal advice. Sign-off on templates and on your processing stays with your counsel; every template is labeled "starting point, not legal advice".
Because Art. 12(1) requires clear and plain communication — in practice, the requester's language. Incumbents put multi-language on paid tiers (Iubenda: one language on Essentials; Termly: multi-language only on Pro+). The kit ships English, German, Italian, Japanese, Korean and Thai in the base price.
Nowhere near us. The intake form is static HTML/JS you host; submissions go to the webhook or inbox you configure. That design also keeps the vendor out of the GDPR processor role (Art. 28) — a big part of why this is a kit and not a SaaS.
The deadline matrix and templates carry their sources and a check date (September 2026). Updates within v1.x are free — re-download any time from your download page. The kit includes a 15-minute quarterly refresh ritual that tells you exactly what to re-check.
If the kit doesn't fit how you work, write to us within 14 days of purchase and we refund in full — the files are yours to keep or delete. One refund per purchase; we only ask for optional feedback.
$69 one-time · ≈ ฿2,450 · free updates v1.x · instant download
Get the DSAR Response Kit — $69