How to Make a GDPR Request for Your Data

Anyone covered by the EU's General Data Protection Regulation can ask a company what personal data it holds on them and get a copy of it, free. A GDPR request sounds bureaucratic, but it's a short letter or email that triggers a legal deadline. Here is how to write one, what a company must do once it arrives, and what happens if it doesn't.

What counts as a GDPR request and who can make one?

Under Article 15 of the GDPR, "the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data" plus a set list of information: the purposes of processing, the categories of data involved, who the data has been shared with, how long it will be kept, your rights to correct or delete it, your right to complain to a regulator, where the data came from, and whether any automated decision-making logic was used on you.

This is the "right of access," and it belongs to any data subject — meaning any identifiable individual whose data the organization processes. You don't need a lawyer, a reason, or a subscription to the company's service. If a business holds information about you, you can ask it this question.

The EDPB, the body that coordinates EU data protection regulators, has adopted guidelines on how this right works in practice. They direct companies to read a request broadly: a request should be understood as covering "all personal data concerning the data subject" unless you say otherwise, and companies are told to give "complete access to the requested information," per a summary of the EDPB's draft guidance from White & Case.

What must I include in my GDPR request to make it valid?

There's no required form. A request can be written, emailed, or submitted through a web form — the law doesn't force you to use the company's preferred channel. But the EDPB's draft guidance notes that companies are "not obligated to act on a request sent to a random or incorrect email (or postal) address, not directly provided by the controller, or to any communication channel that is clearly not intended to receive requests regarding data subject's rights," as summarized by White & Case. Find the company's data protection officer or privacy contact — usually listed in its privacy policy — and send it there.

Include:

Your full name and the contact details you use with that company (email, account username, customer number — whatever helps them find your records).
A clear statement that you're making a request under Article 15 GDPR for access to your personal data.
Specific categories if you want to narrow the scope, for example your order history with a retailer, or your support messages with a service — or state plainly that you want all personal data held about you if you don't want to limit it.
A current address or email for the response.

Say what you want in plain language — you don't need legal jargon. Don't pad the request with threats or demand unrelated things like compensation; that invites a company to argue the request is manifestly unfounded or excessive, one of the recognized limits on the right, alongside protecting the rights of others and restrictions set by national law, per the same White & Case summary. A company can ask you to verify your identity, but any checks should be proportionate to what you're asking for — not a demand for more documents than necessary to confirm it's really you.

How long does a company have to respond to my GDPR request?

One month. The UK's Information Commissioner's Office explains that for a subject access request, an organization "has to take reasonable and proportionate steps to find your personal information, and provide a response without an unnecessary or unjustifiable delay. This needs to be within one calendar month at the latest (which it can extend for complex requests)," according to the ICO.

Article 12 of the GDPR sets the same rule EU-wide: the controller must act "without undue delay and in any event within one month of receipt of the request." That period "may be extended by two further months where necessary, taking into account the complexity and number of the requests" — but if a company wants that extension, it must tell you within the first month and explain why. If a company decides not to act on your request at all, it must say so within one month, give its reasons, and tell you about your right to complain to a supervisory authority or go to court. The response itself — the copy of your data and the supplementary information — must be free, except in genuinely unfounded or excessive cases.

Here's the practical flow once you hit send:

The request arrives — the clock starts the day the company receives it.
Within one month, the company must either respond fully, respond with an extension notice (complex cases only, up to two more months), or refuse with reasons and tell you how to complain.
If it responds, check the content against what Article 15 requires — the categories, purposes, recipients, retention period, and any automated decision-making logic, not just a vague summary.
If it ignores you, refuses without adequate reason, or sends an incomplete answer, you can escalate to a regulator.

What should I do if a company refuses or ignores my GDPR request?

First, check the stated reason, if any. Article 15 of the GDPR allows a company to limit a copy of your data where giving it to you would harm the rights and freedoms of other people — for example, where a full copy would expose another identifiable person's information. It can also push back on requests that are manifestly unfounded or excessive. What it cannot do is simply go silent, charge you a fee to even ask, or bury the request-handling process behind obstacles.

Regulators have fined companies for that kind of obstruction. Spain's data protection authority fined the security company Securitas Direct €100,000 after a consumer association complained that its video surveillance notices "directed data subjects to a chargeable 902 telephone number to exercise their rights of access and objection," which "was considered to impose a cost on data subjects and to hinder the exercise of their rights," according to the EDPB. The regulator found this breached Article 12(2) GDPR, which requires controllers to make it easy for people to exercise their rights, and ordered Securitas Direct to fix its notices within 12 months.

That case didn't start with a lawsuit; it started with a complaint about a company making its rights process hard to use.

If a company stonewalls you, your move is a complaint to your national data protection authority (DPA) — in the UK, that's the ICO; every EU member state has its own equivalent. The ICO recommends keeping the complaint focused: "Explain your complaint in a clear, specific and short summary... You don't need to use legal terms or quote the legislation... It might help if you limit your complaint to around 500 words," according to ICO guidance. List your concerns separately, explain any harm, and attach only your key evidence — the original request, any response, and dates. The ICO also offers a ready-made complaint letter template you can send to the organization first, if it has no complaint form of its own, before going to the regulator.

Where can I find a template for a GDPR request letter?

Copy and adapt this:

Subject: Data Subject Access Request — Article 15 GDPR

Dear [Company / Data Protection Officer],

I am writing to request access to my personal data under Article 15 of the General Data Protection Regulation.

Please confirm whether you are processing personal data concerning me, and if so, provide:

A copy of that personal data

The purposes of the processing

The categories of personal data concerned

The recipients or categories of recipients to whom the data has been or will be disclosed

The period for which the data will be stored, or the criteria used to determine that period

Information on the source of the data, if it was not collected from me directly

Whether any automated decision-making, including profiling, is used, and if so, the logic involved and the significance and envisaged consequences for me

My details for identification: [full name, account/customer number, email address associated with the account]

Please respond within one month as required under Article 12 GDPR. If you require further information to verify my identity, please let me know what is needed.

If you intend to withhold any part of this data, please explain the specific grounds, and inform me of my right to lodge a complaint with a supervisory authority.

[Your name] [Date]

Send it to the company's listed privacy or data protection contact, and keep a copy with the date you sent it — that's your proof if the one-month clock runs out with no answer.

If you're in the United States rather than the EU, GDPR generally doesn't apply to you directly; the closer US equivalents are state laws like the CCPA. Privacy Unpacked's guide to California's delete-my-data rights under the CCPA walks through that process, and the general guide on how to request your data from a company covers data subject access requests more broadly across jurisdictions.

Updated 15 October 2026: Replaced a dead EDPB link with the live EDPB PDF of the same Guidelines 01/2022 on the right of access.