The data request tracker: answer every GDPR access request before the clock runs out
A public form starts the one-month countdown the moment someone asks what data you hold on them
- A privacy policy or “your data rights” page where the intake form link can live — without it, nobody knows the option exists
- A documented list of where customer data actually lives (booking system, mailing list, invoices, POS) — the tracker manages the clock, not the search
- A machine that stays on around the clock for the three containers and the reminder schedule — a mini PC, NAS or small VPS
- One named person who owns incoming requests, so “I thought someone else was handling it” never happens
Version history
A public form that starts its own one-month countdown the moment someone asks what data you hold on them — so the deadline is never the reason you're in the wrong.
The problem
A customer, a former employee, someone who filled in a form two years ago — any of them can email you and ask what personal data you hold on them, and under GDPR you have to answer within one calendar month. Miss that clock and you've handed a data protection authority an easy, well-documented reason to open a file, even if everything else about how you handle data is fine. Most small businesses have no system for this at all: the request lands in a shared inbox, gets read, gets meant-to-be-actioned, and the calendar quietly runs out while nobody was deliberately ignoring it. The enterprise software that tracks this — DataGrail, OneTrust, Ketch — is built for compliance teams with a data protection officer and starts at four figures a year. A five-person shop that gets two or three of these requests a year doesn't need a platform. It needs a clock that doesn't forget.
The architecture
▼
[ Formbricks — the public request form, linked from your privacy page ]
│ who's asking, what they want, enough detail to verify identity
▼ submission fires a webhook
[ n8n (self-hosted) — the tracker engine ]
├─ creates a case row in Baserow, deadline = date received + 1 month
├─ sends an acknowledgment email within minutes
├─ reminds you 10 days and 3 days before the deadline
└─ flags anything still open on deadline day
[ Baserow — the case log ] one table, every request, every date, one audit trail
Three small pieces, each doing one job. Formbricks only captures the request. n8n only watches the calendar and nags. Baserow only remembers. None of them decide whether the request is valid, whether an exemption applies, or what the actual answer should be — that stays a person's job, on purpose.
Tool choices — and why
Formbricks (AGPL-3.0 core, 12.7k stars, active) is the intake form. Its own licence page says it plainly: "you can use the software for free for personal and commercial use." Self-hosted, unlimited responses, no per-submission fee — which matters here, because a request form that costs money per submission is a strange thing to put in front of people exercising a legal right. A plain form on your existing site would technically work too; Formbricks earns its place by handling conditional fields ("what are you asking for: access, deletion, correction, other") and webhooks out of the box, so it plugs straight into the next step.
n8n (fair-code Sustainable Use License — free for internal business use, ~199k stars, pushed this week) is the engine: webhook in, a date-math node to set the deadline, an email node for the acknowledgment, and two scheduled trigger nodes for the reminders. If you already run n8n for another blueprint in this library — the no-show reminder engine, the quote follow-up engine — this is one more workflow on a box you're already paying for, not a new one.
Baserow (MIT core, 5.5k stars on GitHub — it moved there from GitLab in 2026, where it ranked in the platform's top 10 by stars — active, weekly releases) is the case log. One honest caveat: the free self-hosted tier has no row or storage cap, but the Kanban and Calendar view types are gated behind a paid licence even when you're self-hosting. That's not a problem here — a Grid view sorted by "days until deadline," filtered to hide completed cases, tells you everything a Kanban board would, and it's in the free tier.
Monthly cost. Software: €0, all three. Hosting: one VPS around €8-15/month runs all three containers comfortably for the volume a small business actually sees — most SMBs get a handful of these a year, not a stream. If Baserow or n8n is already running something else in this library, the marginal cost of adding this workflow is close to zero.
Setup outline
1. Deploy Baserow (official Docker image) and build one table: date received, requester name, requester email, request type (access / erasure / rectification / objection / portability / other), verification notes, deadline (formula: date received + 1 month), status (new / verifying / in progress / completed / escalated), case notes.
2. Deploy Formbricks and build a one-page form: name, email, what they're asking for, a free-text box for details, and a line explaining you may need to verify their identity before acting. Get the webhook URL for the next step.
3. Deploy n8n and build one workflow: Formbricks webhook → create a row in Baserow via its REST API → send the requester an acknowledgment email stating the date received and the date you'll respond by → two scheduled checks (10 days and 3 days before deadline) that email or Telegram you if the matching case isn't marked completed.
4. Decide, on paper, who owns "verify this person is who they say they are" and who owns "actually compile what we hold on them." The tool tracks the clock; it does not do either of those two jobs.
5. Publish the form link somewhere a visitor will actually find it: your privacy policy, your site footer, and the auto-reply on any inbox likely to receive this kind of request cold.
6. Test it for real: submit a request yourself, confirm the acknowledgment email lands, confirm the Baserow row and its deadline are correct, then temporarily shorten a test case's deadline to check the reminder actually fires — don't wait a month to find out it doesn't.
7. Decide your extension procedure before you need it. GDPR Article 12(3) allows two more months for a complex request or a high volume of requests from the same person, but you must tell them, and why, within the first month. Build a "request extension email" template now, and use Baserow's status field to record when you sent it.
Pitfalls — the real ones
The clock starts when the request arrives, not when someone notices it. A DSAR that lands in a general support inbox, a DM, or gets mentioned in a phone call still counts from that date — not from the day it gets forwarded to the right person.
"One month" is a calendar date, not 30 days. A request received on 15 March is due 15 April, whatever the length of March. n8n's simplest date-add-30-days node is a reasonable practical stand-in, but it can drift a day or two either way across months — when it matters, use the actual calendar-month rule, or err toward the earlier date.
This tool tracks the deadline; it does not decide the answer. Whether an exemption applies, whether the request mixes in someone else's data, or whether an ex-employee's request is really a grievance in disguise — those are judgment calls. A first-of-its-kind or borderline case is worth a data protection professional's sign-off, not a guess from a form response. Nothing here is legal advice.
US customers get a different clock, not no clock. California's CCPA (and a growing list of similar state laws) gives consumers comparable request rights, but on a 45-day deadline, extendable by another 45 with notice — not GDPR's one month. Same tracker, different number in the formula field; check which law applies to who's asking.
Going quiet is worse than going over. If you're going to miss the deadline, GDPR Article 12(3) still requires telling the requester and explaining why, within the first month — silence is the actual violation people report, far more than a case that ran a few days long with a clear explanation.
Verified repos
Formbricks — AGPL-3.0 core, 12.7k stars, active (2026)
n8n — Sustainable Use License (free self-hosted internal use), ~199k stars, active (August 2026)
Baserow — MIT, 5.5k stars, active (August 2026)
Get the next blueprint as it publishes — free, practical, verified tooling only.
Get this blueprint tailored to your business — free
Tell us what you run and where. We research your sector's specifics — rules, tools, customer habits — and send you a version of this blueprint rebuilt for your situation, usually within 24 hours.