Know what is on your site before a plaintiff’s firm does.Free website scanScan Your Site
Log in Sign up Book a demo
Solutions / DSR Portal
Consumer-Facing · On Your Domain

The page your visitors use to exercise their rights.

A branded request portal on your own domain, the front door your privacy notice should link to. Visitors pick a request, verify who they are, and track it from submission to close. Behind it, Captain Compliance handles the workflow, routing, and deadlines automatically.

DSAR Demo Learn More
GDPR · CPRA · LGPD · DPDPOn your domainIdentity verifiedLive status tracking
Acme Privacy Center
privacy.acme.com

Submit a privacy request (Illustrative Example)

Tell us what you'd like to do with your personal data. We'll verify it's you, then handle it within the legal deadline for your region.

I want to…
Email on your account
Where you live
Statutory deadline: 30 days · GDPR Art. 15–22

Request received

We’ve emailed a verification link to you@example.com. Once you confirm it, the clock starts and you can track everything here.

Reference
DSR-7F3A-2196
Access request · EU · GDPR
  • Request submittedJust now
  • Verify your identityCheck your inbox
  • We gather your dataAutomated across your connected systems
  • Response deliveredEncrypted download, 30-day link
Estimated completion: 4–6 days
Full Subject Rights Request Automation

Effortless for the visitor meeting regulatory requirements. Fully wired underneath to make processing seamless.

The portal a data subject sees is deliberately simple to lessen regulatory scrutiny. Everything that makes a request defensible happens behind it, the moment they hit submit.

WHAT THE VISITOR SEES
  • A page that looks like your site, on your domain, in their language
  • Simple, secure, and easy to use DSAR Form
  • An email verification link, no account or password to create
  • A reference number and a live status tracker they can revisit
  • An encrypted download when their request is processed
WHAT HAPPENS BEHIND IT
  • The right DSAR clock auto-attaches based on their region
  • Identity verified by email loop, with optional verification layers
  • Request routed into the admin triage queue for your team
  • Connectors pull from your connected systems of record automatically
  • A regulator-ready evidence pack is assembled and hash-anchored
EVERY RIGHT, ONE PORTAL

The requests your visitors can file.

A

Access

A copy of everything you hold about them, packaged as readable PDF plus machine-readable JSON.

GDPR Art. 15 · CCPA/CPRA · LGPD · DPDP
D

Deletion

Erasure across every connected system, with reasoned exceptions logged where a legal hold applies.

GDPR Art. 17 · CCPA/CPRA §1798.105
C

Correction

Rectify inaccurate data, with the change propagated to downstream systems and processors.

GDPR Art. 16 · CCPA/CPRA
O

Opt-out & do-not-sell

Processes opt-out and do-not-sell/share requests, applied consistently across ad and analytics destinations.

CCPA/CPRA §1798.120
P

Portability

A structured, commonly-used export the subject can have.

GDPR Art. 20 · CCPA/CPRA · DPDP
R

Restrict & object

Pause or object to specific processing, including profiling and automated decisions.

GDPR Art. 18 & 21 · CCPA/CPRA
THE PART MOST PORTALS GET WRONG

Verify the right person, without a privacy theatre.

Handing data to an impersonator causes the very breach you were trying to prevent, it's the top DSAR failure mode. We tier verification to the request's risk: a simple email loop for low-risk access, a knowledge or document check for deletion, and for enterprise accounts a fraud score that flags anything suspicious before a human ever sees it.

CCCompliance Shield covers wrongful-disclosure claims on Enterprise plans.
VERIFICATION LADDER
  • Tier 0 — Email round-trip for opt-out & access
  • Tier 1 — Knowledge check against account facts
  • Tier 2 — Government-ID document check for high-risk requests
  • Gate — Fraud score holds anomalies for manual review
  • Agents — Authorized-agent & parental-consent flows
STAND IT UP QUICKLY

Your logo, your domain, your privacy notice’s link target.

The portal can live on your site with your color palette and tone. Living from the "exercise your rights" in your privacy notice and footer.

Host the portal on your own domain and we will help you customize the design free of charge!
TEAM QUESTIONS

Data Subject Request Questions

Do we need every system connected before we launch?+
No. You can launch with the portal alone and route requests to your team manually, then connect systems of record one at a time as your integrations are ready. Nothing blocks go-live.
What stops someone from impersonating one of our users?+
Verification is tiered to the request’s risk, from a simple email loop up to a document-based ID check, with a fraud score that holds anomalies for manual review.
Which deadline applies to a given request?+
The portal detects the visitor’s region and attaches the right statutory clock automatically, for example 30 days under GDPR, 45 days under CCPA/CPRA, and 15 days for an LGPD confirmation, with internal escalations as the deadline approaches.
How is the data itself protected?+
Everything is encrypted in transit and at rest, downloads go out through expiring encrypted links, and every step is logged into a regulator-ready evidence pack you can produce if a request is ever challenged.
How long does it take to make our DSAR live?+
We can do your setup for you in as little as a day.
What is the cost of a fully automated DSR Portal?+
If you need a full customization to fit your systems of record just let us know and we can get you a custom quote for the build out.

Giving your visitors access for their rights.

Stand up a branded request portal on your domain, wired into automated fulfilment.

DSAR Demo Learn More