Write a legally grounded data access request in two minutes, send it yourself, then check whether the company answered on time.
Read it through, then send it by email or registered post. Keep proof of the date you sent it.
Enter the date the company received your request. We work out the legal deadline and what to do next.
You don’t need a lawyer. Companies are legally required to answer.
Pick the law, add your details. The letter cites the right article and lists everything you’re entitled to.
Email it to their privacy contact or send it by registered post. Note the date, since the clock starts there.
Use the deadline checker. No answer in time? You can complain to the data protection authority, for free.
Answering access requests by hand is slow and risky. See the tools privacy teams use to find, review and deliver personal data on time.
A data subject access request is your legal right to ask an organisation for a copy of the personal data it holds about you, plus information on why it uses that data, who it shares it with and how long it keeps it. Under the GDPR it comes from Article 15. In California, the CCPA gives you a similar “right to know”.
Under the EU and UK GDPR: without undue delay and at the latest one month after receiving your request. They can extend by two further months for complex or numerous requests, but must tell you within the first month and explain why. Under the CCPA: 45 calendar days, extendable once by another 45 days with notice.
Generally no. Under the GDPR the first copy is free. A company may charge a reasonable fee or refuse only if a request is manifestly unfounded or excessive, for example repetitive. Under the CCPA, responses to verifiable consumer requests are free.
No. You don’t have to give a reason, and the company can’t refuse just because it doesn’t like your motive.
They can ask for information needed to confirm you are who you say you are, but it should be proportionate. A company that already knows you by your account email shouldn’t need a copy of your passport. Under the GDPR, the deadline may not start until they have what they reasonably need.
Send a short reminder citing your original date. If there’s still no answer, complain to the regulator: your national data protection authority in the EU (for example the CNIL in France), the ICO in the UK, or the California Privacy Protection Agency.
No. The letter is built entirely in your browser. There is no account, no database and no form submission.