Privara — Self-Hosted GDPR DSAR Management Portal
Self-hosted GDPR DSAR portal that tracks every request against its statutory deadline.
The problem it solves
DSARs arrive by email and the clock starts immediately, but most organisations have nothing tracking them — no deadline dashboard, no audit trail, just a shared inbox. Enterprise GRC software is overkill and expensive for a team that just needs to log requests, verify identity, and respond inside the one-month GDPR window without missing it.
- Requests tracked in an inbox with no deadline visibility
- No audit trail of who did what and when
- Enterprise GRC suites priced and scoped for far more than DSAR tracking
What you get
Statutory deadline tracking
The dashboard flags overdue and due-soon requests, with deadline math following GDPR Art 12(3) exactly, including month-end clamping.
Public submission form
A public-facing form with email-based identity verification for intake.
Append-only audit log
Every status change, internal note, and extension grant is timestamped and permanent.
All five GDPR rights
Captures Access, Deletion, Rectification, Portability, and Objection requests, shown throughout the admin interface.
Reusable response templates
Save canned acknowledgement, completion, and refusal text for reuse across requests.
CSV/JSON export
Export request data for reporting or record-keeping.
Installable mobile app (PWA)
Add it to a phone or tablet home screen straight from the browser — a full-screen app served from your own server, with no app store involved. Business data is never cached offline, so what you see is always live.
Own It 2.0 — API, 2FA, backups, dark mode
Privara 2.0 adds the 2.0 owner layer. Upgrade by replacing the files — the database migrates itself, and it is still the same one-time purchase.
- REST API with an OpenAPI spec and signed webhooks
- Two-factor sign-in (TOTP)
- Email notifications through your own SMTP
- CSV import with a mandatory dry run
- One-click backups
- Dark mode
Own It 3.0 — works for your AI, not just for you
An AI assistant can read the register, log a request that arrived by post and move requests through the workflow over MCP — writing through the same transition function the browser uses, so it cannot set a status the screen would refuse. Overdue is computed from the statutory deadline and cannot be set by anyone.
- Roles with email invitations and a last-admin guard
- Append-only audit trail across browser, API and agent
- Printable PDFs
- Your logo and colours throughout
- Scheduled backups with a guided dry-run restore
- Optional single sign-on (OIDC)
Pricing — one-time, yours forever
- ✔ Full source included — PHP you can read and change
- ✔ No subscription. One payment, yours forever
- ✔ It never phones home
- ✔ Your data stays on your server
No reviews yet — so here is what we offer instead. Every competitor price on our comparison pages is source-linked and dated, and when a vendor’s price won’t load we say so rather than guess. See the sources for yourself →
Screenshots
Honest limitations
- No automated data-discovery across systems — it tracks requests, it does not scan your databases for personal data
- Not a full GRC suite: no policies, DPIAs, breach management, or staff training records
- Not built for multi-tenant SaaS platforms needing isolated per-customer workspaces
- Using Privara doesn't itself make you GDPR-compliant — legal sufficiency of your responses is your responsibility
2-minute web installer, plain PHP 8.1+ with MySQL or SQLite (WAL mode), no Composer or build step — Dockerfile included.
Covered in these guides
Spreadsheets are genuinely fine — until specific failure modes appear. The honest thresholds for moving to a real tool, and which category to look at when you cross one.
Deadline timers and audit records are software problems. Legal sufficiency is not. Here is the honest line between them, why a one-time licence suits one side and not the other, and the question to ask any vendor in this category.
Where your business data physically lives, who can be compelled to hand it over, and what "EU hosting" does and does not buy you. The questions to ask any SaaS vendor, and the case where self-hosting answers all of them at once.
Every EU business must answer data-subject requests within a month, and most track them in an inbox. The rented portals run $9 a month to quote-gated enterprise. The self-hosted case has one argument the SaaS versions cannot make — and one honest limit.
Frequently asked questions
Does this make me GDPR-compliant?
No — it helps you meet the deadline and maintain an auditable record of every request; whether your responses are legally sufficient is your responsibility and depends on your jurisdiction and the specifics of each request.
Does it actually send emails?
Yes, via PHP's mail() by default, with SMTP host, port, username, and password configurable in the admin settings panel for reliable delivery via services like SendGrid or Postmark.
What request types are supported?
All five GDPR rights — Access, Deletion, Rectification, Portability, and Objection.
What if the developer disappears?
It's a self-contained PHP script you own and run — no SaaS dependency, no licence server, no phoning home.
Will it run on my shared host?
Yes — plain PHP 8 + MySQL; no Composer, no Node, no cron jobs required; if your host runs WordPress it will run Privara.