Privacy request intake and configuration

Configuration overview

The Privacy Request Manager's Configuration section lives at the bottom of the left sidebar and is accessible to admins and owners. It controls how new requests arrive, how identity is verified, what the public-facing form looks like, and when completed cases are cleaned up.

Make sure you are in the correct matter before changing configuration, because many of these settings are matter-scoped.

Public intake form

The public intake form gives individuals a branded web page where they can submit a privacy request without emailing a shared inbox. Each matter generates a unique intake URL (/dsar/request/<code>) that you can share on your privacy page, in email footers, or anywhere subjects might look.

1. Open Configuration in the Privacy Request Manager sidebar and find the Public Intake Form section.
2. Toggle the form on. Ghost shows the shareable URL. Copy it and place it wherever individuals need it.
3. Submissions automatically create or update cases in the active matter according to rules you configure below.

You can preview the intake form by opening the URL in a new tab from the Matters settings page, where each matter card also has a Copy intake URL action.

Identity verification

Before you fulfil a privacy request you need to be reasonably sure the requester is who they claim to be. Ghost supports two approaches:

• Automatic: when a new intake arrives, Ghost immediately sends the requester a verification email. They click a link to confirm their identity before your team starts work.
• Manual: your team reviews the intake first and decides whether to send the verification email from the case detail view. This is useful when you want to triage before triggering any outbound communication.

Choose the approach that fits your process in the Identity Verification section of Configuration.

Branding

Upload a logo in the Branding section so individuals recognise the intake form as official. The logo appears at the top of the public form. Keep it consistent with the logo on your privacy notice or website so visitors trust the page.

Custom intake fields

The standard intake form collects the basics (name, email, request type). If you need additional information up front, for example an account number, customer ID, or the specific data category they are asking about, add custom intake fields in Configuration.

Custom fields appear on the public form alongside the standard ones. They also surface on the case detail view so your team can see them without having to ask the requester again.

Case data retention

The Data Retention section in Configuration sets timelines for what happens to completed cases:

• Auto-archive: after a set period, completed cases are hidden from the active dashboard but remain accessible through the archived filter.
• Auto-purge: after a longer period, archived cases and all associated data are permanently deleted. This supports data minimisation requirements by ensuring you do not hold request data longer than necessary.

Set these timelines to match your organisation's retention policy. If you are unsure, consult your DPO or legal team before shortening the purge window.

Case templates

Templates save time when many requests follow the same pattern. A template can add default tasks, boilerplate descriptions, checklists, and labels so new cases start with a consistent structure.

1. Open Templates in the Privacy Request Manager sidebar to see what your admins have published.
2. When creating a new case, choose a template from the dropdown if one is offered. The template populates the case form with its defaults.
3. Admins can create and edit templates from the same page. A good starting set might include templates for access requests, erasure requests, and rectification requests.

For the full Privacy Request Manager walkthrough, see Privacy Request Manager overview. For reporting on how your intake is performing, see Privacy request analytics and reports.