> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.omegatheme.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Consentik Shopify: Data Subject Access Request (DSAR) version 2

# Data Requests (DSAR)

## Overview
**Let customers exercise their privacy rights from your store — with verification and a deadline you can't miss.**
Under GDPR Articles 12–15 and similar laws such as the CCPA, anyone whose personal data you hold can ask you to give them a copy of it, delete it, correct it, restrict how it is used, or export it — and you must respond within 30 days.

Data Requests has been part of Consentik on Shopify before, as a page you publish with three buttons — View, Edit, Delete — that any logged-in customer could click. That page didn't verify who was actually asking, didn't send the customer anything back, and left you with a single notification email and no record of what happened after.

This update replaces that page with the same verified, trackable workflow already running on Consentik's Wix app: a dedicated intake channel, unique Request IDs, a mandatory email confirmation step before anything reaches your queue, a dashboard with the 30-day deadline always visible, a processing checklist, and a ready-to-send response email.
*If you had a Data Request page published before, it stops being used once this ships — there's nothing to migrate. You set up the new experience from DSAR Setup, covered in section 5.*

*Consentik transmits and tracks requests — it never accesses, stores, or processes the content of your customer data.*
![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_6txxf7.png)

## How it works
1. A visitor clicks **“Submit a data subject request”** — shown on the cookie banner and/or the preferences popup, depending on how you place it.
2. They pick one of five request types.
3. They enter their name and email (both required), optionally add details, and confirm the checkbox.
4. They see a success screen with a Request ID, e.g. `CST.ACC.A1F4B9.2510091345`.
5. A verification email goes out immediately, with a confirmation link valid for **1 hour**.
6. Clicking it opens the confirmation page: the request becomes **Verified** and the 30-day clock starts.
7. Only now do you receive a notification email — nothing reaches your dashboard before this point.
The popup is responsive on mobile and desktop, and follows the colors you set in DSAR Setup and your store's font.
![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_htkybq.png)


## The five request types
| Type | What the visitor is asking for |
| ---- | ---- |
| **Access my data** | A copy of all personal data you have collected about them |
| **Delete My Data** | Permanent deletion of their personal data |
| **Correct My Data** | Correction of inaccurate data |
| **Restrict Processing** | A limit on how their data is used |
| **Export My Data** | A portable, machine-readable copy of their data (data portability) |

The title and description of every type can be rewritten in **DSAR Setup → Appearance & Content**, so you can match your own wording.
## Where to manage it
Data Requests lives in its own admin page, split into two tabs:
* **Request Management** — your day-to-day workspace: every request, its status, and the tools to process it.
* **DSAR Setup** — one-time configuration, in three parts: Appearance & Content, Confirmation page, and Email templates.
![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_cthmds.png)

## Turning on the feature
In **DSAR Setup → Appearance & Content → General settings**, you control:
* The master toggle — enable the Data Subject Access Request popup.
* Popup position — Center, or one of the four corners.
* Trigger text — the link customers click (default: “Submit a data subject request”).
* Where that link shows — the cookie banner, the preferences popup, or both.
Leaving both placements unchecked shows a warning — the feature can't be reached if the trigger link appears nowhere.
![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_1pimbvq.png)

## Customizing the popup
The Appearance & Content tab controls how the popup looks and reads, with a live preview next to the settings that updates as you type. The preview switches between the three screens a customer actually sees: request type, form, and submitted.
* **Appearance** — background, text, and highlight colors.
* **Request types** — title and one-line description for each of the five cards.
* **Form labels & messages** — every piece of form text, the confirmation checkbox wording, and the submit button label.
* **Submitted screen** — the title and message shown right after submission (keep the Request ID placeholder in it).
![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_1t5mxz9.png)

## The confirmation page
Clicking the link in the verification email opens a standalone confirmation page — not an overlay on your store — that handles four situations:
* **Confirmed** — the happy path: success message, a reminder of the 30-day window, the Request ID, and an optional summary of what was submitted.
* **Expired link** — shown once the link passes 1 hour old; offers a fresh submission.
* **Already confirmed** — reassures a customer who clicks the link twice; it does not send a second notification.
* **Invalid link** — no matching request; nothing happens, and no detail is revealed about why.
Title, message, store name, button labels, and page colors for all four states are editable from this tab.

![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_1obalug.png)

## Email templates
Three emails make up the flow, all edited under **DSAR Setup → Email templates**:
1. **Verification email** (to the customer) — sent automatically the moment the form is submitted. Contains a summary, the confirm button, the 1-hour expiry notice, and the Request ID.
2. **New request notification** (to you) — sent only after the customer verifies. Contains the Request ID, type, email, timestamp, any extra details, a reminder of the 30-day deadline, and a button into the dashboard. The recipient address is set here too.
3. **Final response email** (to the customer) — not automatic. You send it yourself from the request drawer once you've done the work; the summary is pre-filled based on the request type, and you can attach files.
Every template supports variables (name, Request ID, type, and more), a rendered preview, and a test-send button for the two automated emails.
![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_xxsm1d.png)

## Managing requests
Requests appear in Request Management only once the customer has confirmed their email — an unverified submission never reaches this list, so nothing shows up for you to act on until it's real.
You can search by email or Request ID, filter by type or status, and sort newest or oldest first. Each request moves through:
* **Verified** — confirmed, waiting on you; the 30-day clock is running.
* **In Progress** — you've started the work.
* **Completed** — fully handled.
* **Rejected** — declined, with an optional internal note explaining why.
* **Expired** — passed 30 days unresolved; set automatically, not editable by hand.
![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_1w8fpzq.png)

Opening a request slides out a drawer with everything for it:
* **Overview and submitter** — copyable Request ID and email, type, status, timestamps, and a **"Respond by {date}"** callout for open requests.
* **Processing checklist** — a tickable, type-specific list of the actual work (locate the data, check retention obligations, clean third-party tools, prepare the export file, and so on), with an *X of Y done* progress bar.
* **Internal notes** — only visible to you, never sent to the requester.
* **Send Final Response Email** — opens a popup with the attachments and a preview of the message built from your template and this request's own data. For **Access** and **Export** requests the prepared data file (JSON, CSV, or PDF) is mandatory: sending is blocked until one is attached. For the other types attachments are optional.
* **Activity** — submission, verification, notification, every status change, and the response you sent.
![](https://storage.crisp.chat/users/helpdesk/website/-/8/3/8/3/8383e5404a31c000/image_35pkiu.png)

## Important notes
* **Plan availability.** Data Requests is available on the **Advanced** plan.
* **Requests reach you only after verification.** The email confirmation step is what keeps spam and impersonation out of your queue, so a visitor who never clicks the link never becomes a task for you.
* **Confirm links last exactly 1 hour.** If a visitor waits too long, they simply submit again — the expired page tells them how.
* **The Request ID contains no readable personal data.** It is built from the request type, a one-way hash fragment of the email, and the creation time, and the same ID is used in the popup, all emails, the confirmation page, and your dashboard.
* **The 30-day deadline runs from verification, not from submission**, and requests that pass it are marked Expired automatically. Expired requests stay visible for your records.
* **Fulfilling the request is your job, not Consentik's.** The app never touches your customer data — it gives you the workflow, the checklist, and the audit trail.
* **Languages.** The popup, the emails, and the confirmation page are shown in the single language set in your configuration.
* **Not legal advice.** Response deadlines and obligations vary by country and by law. Confirm your setup with your own legal counsel.