Data request letter generator

Most people never send these letters, not because the right is unclear but because the wording feels like a legal exam. It is not. A valid request only has to identify you, say what you want, and name the right the law gives you. This writes it for you.

You

Full nameEmail the company knows you byOther identifiers they may hold (optional)

Them

Company nameSend to (their privacy or DPO address)

Your letter

Subject line

To the data protection officer or privacy team at [Company name],

I am exercising my right of access under Article 15 of the General Data Protection Regulation. Please provide:

  1. confirmation of whether you process personal data concerning me;
  2. a copy of that personal data;
  3. the purposes of the processing;
  4. the categories of personal data concerned;
  5. the recipients or categories of recipients to whom it has been or will be disclosed;
  6. the envisaged retention period, or the criteria used to determine it;
  7. the source of the data, where it was not collected from me.

You can identify me by the email address [Email the company knows you by].

Under Article 12(3) you must respond without undue delay and in any event within one month of receiving this request. I therefore expect your response by 2026-09-04. If you intend to rely on the extension of two further months, please tell me within that first month, together with the reasons.

Please reply to this email address so that there is a written record. I am not asking for anything beyond what the law already requires.

Yours sincerely,
[Full name]

Open in email

This is a template, not legal advice. It reproduces rights that exist in published law and nothing more. Whether a given company is covered, and what it may lawfully refuse, depends on your situation. Nothing you type here leaves your browser: no server, no analytics, no storage.

What the law actually gives you

Request	Legal basis	Deadline to answer
See what they hold	GDPR / RGPD, art. 15	One month, extendable by two further months
Have it erased	GDPR / RGPD, art. 17	One month, extendable by two further months
Deletion (California)	CCPA	45 days, extendable by another 45

The GDPR deadline comes from Article 12: the controller must respond without undue delay and in any event within one month of receipt, and that period may be extended by two further months where necessary. For California, the Attorney General states businesses must respond within 45 calendar days and may extend by another 45 if they notify you.

Three things that make a request harder to ignore

Name the article, because a request citing Article 17 lands on a different desk from one asking to close an account. Give them enough to find you, since most refusals are really failures to match you to a record. And put the deadline in writing, which turns a vague ask into a dated obligation and is also the evidence you would need if you later complained to a supervisory authority.

If nothing comes back

Silence is itself a breach of the deadline. In the EU and the UK you can complain to your national data protection authority, and you do not need a lawyer to do it. Keep the sent copy and the date: that is the whole evidence file.

Related reading: What is a data broker