A privacy request starts a legal clock the day it arrives. Answer every one of them on time — in 6 languages.
GDPR gives you one calendar month, US state laws 45 days, and the clock starts at receipt. This kit ships the intake form, the EU/UK/US deadline engine, a status board, and 36 response templates (6 request types × 6 languages) — self-hosted files, so your requesters' data never passes through anyone's server but yours.
Real screenshots
Captured from the actual files — not mockups. Click any image to enlarge.
Select an image to view it larger
Try before you buy
Check the real thing first — then decide.
**Betreff:** [REFERENCE_ID] — Ihr Löschantrag ist abgeschlossen Sehr geehrte/r [NAME], wir haben Ihren Löschantrag [REFERENCE_ID] vom [RECEIVED_DATE] abgeschlossen. Dieses Schreiben bestätigt, was gelöscht wurde, was wir aufbewahren müssen und aus welchem Grund. **Was wir gelöscht haben** Folgende Daten über Sie haben wir gelöscht oder dauerhaft anonymisiert: [DELETED_LIST — z. B. „Ihr Kontoprofil samt Zugangsdaten; Bestellhistorie außerhalb der gesetzlichen Aufbewahrungsfristen; Support-Verkehr"]. **Backups** Backups werden für Einzelanfragen nicht wieder eingespielt. Kopien Ihrer Daten rotieren automatisch aus — spätestens am [BACKUP_DATE].
| Jurisdiction | First response due | Extension | Notice due | | EU/EEA (GDPR) | 1 calendar month | +2 further months where necessary | Within the first month | | UK (UK GDPR) | 1 calendar month | +2 further months (same condition)| Within the first month | | US state laws | 45 days | +45 more days in many states | Within the initial 45 | "Calendar month" means month-for-month: a request received 20 Sep is due 20 Oct. The `due-date.js` engine implements exactly this rule — `--selftest` guards it (9 clock cases, incl. received 31 Jan → due 28 Feb).
PLAYBOOK/ deadline-matrix.md Statutory clocks EU/UK/US + sources + quarterly refresh 01-intake-and-identity… Capture, routing, 4-rung verification ladder 02-data-mapping.md Stores inventory, search patterns, scope decisions 03-redaction-and-review What to redact, safe technique, second pair of eyes 04-fulfillment-and-del… Access/portability packaging + delivery channels 05-refusals-and-extens… Deletion workflow, lawful refusal grounds, extensions 06-logging-and-audit.md Tracker discipline, monthly audit, complaint response
Look inside — 3 real excerpts
Unedited excerpts from the actual documents. If the style fits how you work, the full version goes much deeper.
What's inside
The exact file list you receive — 60 files, nothing hidden behind an upsell.
- README-buyer.md · MANIFEST.md · LICENSE.txt
- screenshots/ — 5 rendered previews
- readme-buyer · deadline-matrix · playbook-stage1
- template-en-deletion · tracker-readme
- PLAYBOOK/
- deadline-matrix.md
- 01-intake-and-identity-verification.md
- 02-data-mapping.md
- 03-redaction-and-review.md
- 04-fulfillment-and-delivery.md
- 05-refusals-and-extensions.md
- 06-logging-and-audit.md
- templates/ — 6 langs × 6 types = 36 files
- en/ · de/ · it/ · ja/ · ko/ · th/
- 01-acknowledgment.md … 06-refusal-exemption.md
- intake-form/
- index.html · app.js · config.js · INSTALL.md
- sla-tracker/
- tracker.csv · due-date.js
- board.html · board.js · README.md
The playbook — a 6-stage SOP
Intake to audit log: a 4-rung identity-verification ladder, data-mapping checklists, redaction rules, lawful refusal grounds. Each stage is a working checklist, not prose.
36 response templates, 6 languages
6 request types × EN·DE·IT·JA·KO·TH. Replace [COMPANY_NAME]-style placeholders and send. Every file carries a not-legal-advice disclaimer in its own language.
The clocks, the tracker, the board
due-date.js (zero-dependency Node) computes EU/UK/US deadlines and warns 7/3/1 days out; tracker.csv is a 15-column log; board.html shows every open request and its countdown.
Real files from the zip, rendered as-is — no mockups.
Who's behind this?
Zicula is a one-person studio — hi, I'm Zic. Every kit here, including this one, is written, tested and shipped through documented process, and the support email is answered by me, not a helpdesk. This store's own build, QA and deploy pipeline runs on the same kind of SOPs and checklists we sell.
- Free sample, instant download — no email required.
- 30-day refund, processed in Stripe — no forms, no interrogation.
- Free updates for v1.x — full history in the store changelog.
- Real human support: [email protected]
Free sample
Try the real thing before paying.
What's in the sample:
- deadline-matrix.md — the full statutory clock table with official sources
- the deletion-confirmation template in English and German
- tracker.csv — all 15 columns, 6 example rows (EU/UK/US)
- README listing everything in the full 60-file version
Honest comparison
The free and paid alternatives are real. Here is when each one makes sense.
| Do it yourself / free tools | Monthly SaaS | This kit | |
|---|---|---|---|
| Response letters | You draft each letter from public regulator guidance, then get the register right in every language you answer in | Iubenda puts its DSAR tool only on Ultimate — $99.99/mo billed yearly, per site (checked 2026-09-20) | 36 letters ready to send — 6 request types × 6 languages, one consistent register, disclaimers built in |
| Deadline math | One month vs 45 days vs extensions — tracked by hand, easy to miss after a week away | Secure Privacy: DSAR workflows start at $59 per domain per month (checked 2026-09-20) | due-date.js computes EU/UK/US clocks per request, warns at 7/3/1 days, flags overdue rows in CI |
| Intake & records | A plain contact form — no request-type routing, no reference IDs, no audit log | Hosted for you — but requesters' data lands on the vendor's servers, and the fee recurs | Self-hosted intake form + 15-column tracker + local board — request data never leaves your infrastructure |
| Cost after year one | Free — the cost is your evenings and the risk of a missed clock | $708–2,988+ per year at the published entry tiers named above (checked 2026-09-20) | $69 once. Updates for v1.x free |
The free route is real: the EDPB's Guidelines 01/2022 on the right of access are public, and if you receive a handful of requests a year, answering from a blank page with counsel's help is a legitimate choice. What $69 buys is the assembled operation — 36 letters in consistent legal register, the clock math already coded, the board, and a 6-stage SOP — for less than one month of the cheapest plan that includes DSAR workflows (Iubenda Ultimate $99.99/mo billed yearly · Secure Privacy Business $59/domain/mo — both checked 2026-09-20). This kit is not legal advice: every template says so, and counsel should review before first use.
Frequently asked questions
What exactly do I get?
One zip, 60 files: a 7-part playbook (deadline matrix + 6 stage checklists), 36 response templates (6 types × 6 languages), a self-hosted intake form, and the SLA tracker — CSV log, due-date engine, local status board. The free sample above shows real files before you pay.
Is this legal advice?
No. Every template and playbook page states plainly that it is an operational starting point, not legal advice, and that a qualified lawyer should review it against your actual processing before first use. The kit organizes the work; it does not replace counsel.
Where does requesters' data go?
Nowhere near us. The intake form and tracker are files that run on your own hosting — submissions go to the inbox or webhook you configure, and the log stays on your machine. We never receive, process or store any request data, because there is no hosted service at all.
Which laws does the deadline engine cover?
EU/EEA and UK GDPR: 1 calendar month, extendable by 2 with a notice inside the first month. US comprehensive state privacy laws: 45 days, most extendable by 45. The matrix quotes each rule's official source and includes a quarterly refresh ritual; for other jurisdictions it tells you to default to the strictest applicable clock and confirm with counsel.
What if it doesn't fit my work?
Email [email protected] within 30 days of purchase and you get a full refund — no interrogation, and you keep (or delete) the files.
What does the license allow?
Use it for your own organization and your own clients, forever. Don't resell or redistribute the files themselves — teammates and client engagements run from your copy.
One price. Yours for good.
No subscription, no per-domain fee, no per-request meter.
≈ ฿2,380
- All 60 files: playbook, 36 templates, intake form, tracker + engine + board
- Free updates for v1.x — clock and source refreshes included
- Instant download after checkout
30-day full refund — one email is enough
Buy now — one-timeWhy $69: it stays — less than one month of the cheapest plan that includes DSAR workflows (Iubenda Ultimate $99.99/mo billed yearly; Secure Privacy Business $59/domain/mo — both checked 2026-09-20).
Secure checkout via Stripe · taxes calculated at checkout
Set it up this afternoon, answer the next request on time
One-time payment · free updates v1.x · 30-day refund
Get the DSAR Response Kit